201212091900 14knfu

explained decrypted filler

seed 106

Metadata

Post ID: 14knfu
Title: 201212091900 → 2012-12-09 19:00 on A858's clock
Posted (UTC): 2012-12-10 00:00:03
Timezone: UTC−5 · title 19:00 against posted 00:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212091900) = a1f1e7c33ae10b9c6aee0125373d19a0 (name+title)
GUIDs: 9
Filler GUID seed: new Random(106).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 94 · predicted N = 9 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 11 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

61C1117467FF02D8 F7DF1404A9E3BFBD B5E23950EC197C50 B9F30125620D57F5 F371C091487751E7 3D795A87C76889C3 D8C14397C9701BBE D75DF89E9AA24BED FF0260C5ACA1D9C5 2A932DA8D1C0D141 4E5000AB80D41EB4 D963F0F56C38CD11 E536A9A2DB2C01C2 D1DF27D18BAAD132 D9D3967B7FAA3F7F 8CC14A0FC50DAFFE AE03D3AA3070800A 91C1312F708FB2A5 EC419B347D250BBE 1F0146B7D459FB68 2013246E532E004E 5F86348AD439685A 52D0218243B5EDE8 6D5958F571086D6C C457882BA2220924 1E972AB9D47AEA7B A5A0C2EFDB571121 3703C71AB93F10F6 D26DA26FABDA4E83 4773E4FAD4CA634D 9DBB9274998F2F88 C8920CB82D90EDDE 4A827B4BB5446C91 93E56A49C68439FF 4BD04AFA08CC6C00 7003FD8D991B3653 C3F2E2BCD09D47DF

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212091900 (name+title). Key = MD5(password) = a1f1e7c33ae10b9c6aee0125373d19a0, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9a52ab50-7f3a-065f-8ece-4dfcd95de12d
  2 dff6c3c2-d06a-87dd-8ca4-fdfd529d0ba2
  3 056c8c80-f710-7843-834b-231db8fb200f
  4 abfc740c-81b6-1eab-9685-becbbdc3b96e
  5 c10f0be5-379d-093c-a08d-0e0b8eb76fd4
  6 bdd1ff90-763d-120b-ad84-b50e75a3747f
  7 0c5b31e8-ebb7-378b-98f8-ac1c95c75311
  8 17dcdcad-dbca-52f5-af41-c8ae150a344b
  9 9a345b87-9664-0c08-afb7-b23e7b8d9bb3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 087101350. Exactly this sequence comes out of new Random(106).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 94 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related