201212080800 14h0tv

explained decrypted filler

seed 802

Metadata

Post ID: 14h0tv
Title: 201212080800 → 2012-12-08 08:00 on A858's clock
Posted (UTC): 2012-12-08 00:00:31
Timezone: UTC+8 · title 08:00 against posted 00:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212080800) = dc582fa478497b3cf5c67ebe2661dfe2 (name+title)
GUIDs: 21
Filler GUID seed: new Random(802).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 86 · predicted N = 21 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 2
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7EEB93955F96D179 3B74A7EB72B2EFA2 D9F6904AA574DA4E 1B7148DF401BFE1E B156CF3C485687FD 13C2211696C47A88 6E889CC1942FD459 EF4740B6507CC769 9788CC1E6FAD3B0E 402825521AE51874 683CD71CC07BBFE7 5E66C5FB90D596BD E001F3959A89B390 6310392D203AE265 E0CEC607FDC654AE 7BE7CAA8AC11939C 12BE550FB35E5F15 109596D049881132 2EBB8E5645D3CF39 047A8FFDF489822D 57BA660680316D0D E913732EC8227BB9 FA7C3BA37539DCD9 D9E86A53820C1C17 BB76ADCF7127D7CB 8AE41E53CBE9113F CBC2E65CCAC75BED 18930820B015869E F58C84C54C84DC8B DD136D0B9F8264C7 9C99AC7A115BFA75 989AD6CD9DF71155 9F6DFDBBC09BB0E3 24DF35446AC54645 466C318FCFDDD15B 86E520B501A45965 3F966D5070707949 40630CE1A950A3BD 4846DC936F853DC6 DD9791A8C7FB06C0 1420D2EFEBD976F7 DBB3D55610F279EF CC9CB7DF43F277F5 8BE3A96BF2B73199 C91766046B935518 9A7B3DC39F55FC44 297A785107793334 ADC14118A47B6751 FF52F9B135BBFDA1 49F47AF6BCAAA619 2D51520EA06872D2 3DD8E3F5DE3D3898 9B9B0065478172BC 2B09F77382A38C3B FBB779D865973195 8BECFD491F58AA49 606505D1938F22EF 5D6CCD8282CE4AA5 3AA040144D931D0D D36FEF919DCA029C 78677291DF431EC2 729CFDB55F41E265 4F671A779C2D66CB E74B34FB7CD81AC9 663346FA35430CBE F3D6D2E9B93B67C2 C72E1D6452E666A0 CC29893EC9CDE91D 8F64BACEF9C607E3 9ECF240CCA8B7BF6 E0A2B5E5377FEBF6 5210683DF24D5B2F 5C15F2954AC9B348 E52A5206AB56DF37 E6720F0E69213E35 37C1E84DE88D96FC 86A534B38A284CEC 0F5AF8EC1C70BADD 2D3E589A9E0EFA84 A897F7FCB56FDA40 F04B727BAF5CC5F5 42BE5DFAEF5F07A3 362791CBB1FD49BA C27EB687B3D451D5 B6B8885BE6C36FD6

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212080800 (name+title). Key = MD5(password) = dc582fa478497b3cf5c67ebe2661dfe2, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 58066b13-7bb8-66ee-a5cf-d489c3a0dcc5
  2 d6832252-0340-17ec-9040-e53daba15098
  3 07915fff-69e8-3ff5-b86e-b92ec85de48a
  4 20b90573-74ea-6320-8cd1-4dba60bcd245
  5 3e425f9d-06a7-2be9-93e0-26b1c282cc44
  6 4fe12f4b-88b3-3e95-bea6-67bd1f6b3367
  7 69cb7af1-aad4-2782-881c-9c71a18dd39f
  8 f6bf1c8a-a948-7bcb-b92d-bad09040111e
  9 4c2fda93-179f-1a08-b884-bdb9f593791d
 10 22ca62f1-06c6-0959-8cea-1fdda1d217f4
 11 53dc9862-2491-11be-bce7-384410d7c3b5
 12 d52e1c73-5684-5cba-afa6-48c6ff919c18
 13 e1c83ea1-3b4f-8470-abf5-4ac33af275bb
 14 8377f9fc-afef-601f-92dc-a0a788f325e9
 15 8bc86b86-9970-326c-9399-1d02ec4b85e4
 16 551162d9-c222-8e14-8d87-ce46b65a8d5a
 17 6341c6e0-6083-8f83-8cc5-a9bdfb3e1d55
 18 d5552df0-f01e-2221-9d5d-6fdbacf64b11
 19 ca420128-6982-3aa3-9c43-107c00599724
 20 cc5b307e-c44e-748c-9483-bee972060ef5
 21 acd41c7e-9232-3480-96fe-671bd561f0b2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 613623271015863882373. Exactly this sequence comes out of new Random(802).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 86 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related