201212100100 14lakj

explained decrypted filler

seed 687

Metadata

Post ID: 14lakj
Title: 201212100100 → 2012-12-10 01:00 on A858's clock
Posted (UTC): 2012-12-10 06:00:04
Timezone: UTC−5 · title 01:00 against posted 06:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212100100) = 41389a2c54010eb6c800a70da114c807 (name+title)
GUIDs: 9
Filler GUID seed: new Random(687).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 95 · predicted N = 9 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 15 · 8
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7C94B292AE40D4AA EC267EB050299732 F471A974A568581C CCD095A641D235DE E2DE292B99908EF2 0F7C9CC740078D7C FA558AAE7EDB374A E631A79A47BB4073 816CEA7418261922 7CDB41D587DAD27F 9C7F9F0D39AE7931 1BBAD45C3C46C0A2 2E7D935F670F5452 222B70BEE68429AD B26BAE826A6BE59B BC3B04FC80901D6D FD13489B7578A395 B37F1CEB80C6D538 0FAAD94A573C8918 F149CCFAFB5F26BE 59E9F2BE11F80136 17E1930EC2EA0D1D 10D0D8D7BC2E0DC8 93CEA4A1A0A56586 5782B4464E41F58C BA691AD502775E01 AF7A49E6BFF2E8D4 34DDEFCAC494F1D3 65FD95BC40E3EDB0 01D39E462CFABC82 DE678DD1B9FC9034 37B6A3D35B4BC899 E40325EE530CE3B5 E336603FF09BDE72 E5166789CA42AA78 C92AF19B5D4D71A4 50C864383C3327EA

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212100100 (name+title). Key = MD5(password) = 41389a2c54010eb6c800a70da114c807, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0eaed33d-8f30-55dc-90a0-4f1f2f3e04b9
  2 e4549f60-491a-3280-8694-ee1ef03c9236
  3 903d2162-017d-8418-ad7c-f3a1eff98087
  4 bcee04a9-029c-1785-9882-f454d2f38be0
  5 29421129-d754-370d-bb1d-70cf18b21361
  6 e8527d70-af9c-875d-a414-72ea8b6dc424
  7 38b25ccf-e5d5-69a8-8cf0-d44d9d8afd79
  8 1073fb61-731d-09f9-b4d0-4a230251f38a
  9 5a47c3c1-4834-8a4c-a006-f13aa4aa96e8

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 538138608. Exactly this sequence comes out of new Random(687).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 95 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related