201212101300 14m4fm

explained decrypted filler

seed 944

Metadata

Post ID: 14m4fm
Title: 201212101300 → 2012-12-10 13:00 on A858's clock
Posted (UTC): 2012-12-10 18:00:05
Timezone: UTC−5 · title 13:00 against posted 18:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212101300) = 338ac02b752fa4c5537adb2de35cd0b8 (name+title)
GUIDs: 11
Filler GUID seed: new Random(944).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 97 · predicted N = 11 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 29 · 12
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6BF993D18C9886EC A0854C09E068A4E4 813AE468EE141A43 A761D853D1BD483B 85EEE0BF000C4FF9 6A5F388A9EC396F8 CE8ECD7F08B6B2FE 6B92C0496FF62F82 EF97C412180C0B6A 1BD534EBA0B56E2E 87F605B7605CD7C0 69574978BC71FCB2 F6E9E24BA9F190A5 30BDF392A2DB1AC8 98AD1861BAD54933 654671BDF3252994 792099DA7FEE08E5 A97D5F01A73A0FAE CC080EE69902BB60 D4654DA641F3EED3 4112DB611CB78281 2E63D0C89899F022 30284E1E49A634F5 972B0E92063F8790 51284049EF4EBD18 BFC4F0A3CAD40F6F A1E7AE5F6AA92E8E 3CC24778BB631B65 AEDA97C405FEFD81 AB0CE8B2C3B20831 D6AC955AB4EC6A3B CB6432EB138CB7C3 F44318E464FCBFE7 9A66D48B34E1E0E2 EA61DFB36FC7A191 2A87567B07FE7829 7130D94DD1431D75 C7E001B9E0B221E6 E0B1BD74B9E740FE F8305E7C6045DEF5 D84C9643AD1E67F0 FD2F4107BD195885 2B12124FFCC9EFD6 B24F29327CE2C7DD EE9A57045A173A7C

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212101300 (name+title). Key = MD5(password) = 338ac02b752fa4c5537adb2de35cd0b8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9019ca40-f79d-88aa-87b4-a0c057c99cf1
  2 3ffd4a5f-9bbb-74d5-8852-952db618b972
  3 5fb5d7eb-72d4-594c-87a5-73d3769505b5
  4 386a84cb-f081-00b6-85c8-bec8c2c2dff7
  5 228c74b6-4519-32e8-9477-dad0cd2be125
  6 4d63e4e9-c2a6-4664-9ae2-cf20f8235f0f
  7 186dd98f-58fd-7407-9497-83a57a8ce3e1
  8 d28fc47c-45b2-0bb7-aac6-788407289580
  9 db8826f4-b4bc-6f61-a65e-91b34d39ae37
 10 5c270ea6-f93e-3719-9d30-2c8852098823
 11 7ad93e6e-75cb-6aeb-b618-b32129ac86a2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 87503470636. Exactly this sequence comes out of new Random(944).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 97 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related