201212071800 14frxs

explained decrypted filler

seed 18

Metadata

Post ID: 14frxs
Title: 201212071800 → 2012-12-07 18:00 on A858's clock
Posted (UTC): 2012-12-07 10:00:26
Timezone: UTC+8 · title 18:00 against posted 10:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212071800) = 43c5ab0eb8f94babac5fce3041ae6783 (name+title)
GUIDs: 11
Filler GUID seed: new Random(18).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 79 · predicted N = 11 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

38C09028E2DADBED D2D71F81103DB76F A5C914B6B567EA1B EFFA1D097969AF73 C72316E5B2FBFC4B CFFABA9AA4D910DA 4E7D287C0F724F55 9E9FEEC44C3550E2 F6D5EB9EF6D8F73D E9175095E517B925 9EBFC8328387B22A F93B6214FEB79F54 B0EEE0906F3894EF 91243C4473077132 EA210266716066A7 1D9D8E5C4CB8ACCE AD3804167E18EEAE A2EF1B70A773FB78 BC5EE9414847ED83 76DCA94091FDBD9F 3BA868D39CAA33C4 87631864DB6682FE 3D7143410619FA1C 319FC5AAA81EDF8D EA447B47356C4DDC C432E7B7C70BEE26 6F5C3357833BA047 C439FA09BFCF3EFB EFD2F8226533F590 F8135F83C1F40BED 80092C7057C8D740 41938211B91E82F8 9546ABBCFE4F13C3 7D806EC714F8AFAC 72D6614AA0905181 1A20908D41D67056 46318CB4B2C5504B C4201AC806DCDD04 2EB82196E768E346 38189AF110328DAB 1882A35F83CEF506 8514D0E0DC7BD237 C009E9BA43C85CDE 04A1EB6BF4DE82B5 7BD7169A1BBE8FC1

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212071800 (name+title). Key = MD5(password) = 43c5ab0eb8f94babac5fce3041ae6783, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 df370675-c5e7-1240-b436-cb508e5b5ae5
  2 4347ce7b-59d4-0bd9-9062-ce857dab389f
  3 7bf6e5ba-0815-3bca-9ab4-4f2c0f8ffb88
  4 fbfea9c8-b872-3e47-aeac-6fd91b1632a7
  5 ae6ade31-0022-2c00-855f-0c0e74badb70
  6 117c1212-7918-26ef-95b6-9acd2f4520b1
  7 d57d17a7-ca62-8769-ac06-c5ed9f69c89c
  8 c7cc7950-cdd9-4485-8ed4-5afafda4f4e5
  9 451fea61-c28d-1cba-9de2-1f78a5ac1217
 10 01632be4-cd33-8f90-a57f-26125ce71cd4
 11 0e8454ef-7037-425d-9412-850c01f8d8f5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 10332284184. Exactly this sequence comes out of new Random(18).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 79 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related