201212110700 14ntdm

explained decrypted filler

seed 890

Metadata

Post ID: 14ntdm
Title: 201212110700 → 2012-12-11 07:00 on A858's clock
Posted (UTC): 2012-12-11 12:00:07
Timezone: UTC−5 · title 07:00 against posted 12:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201212110700) = 80aee708f5f77db8aff6363b64801316 (name+title)
GUIDs: 18
Filler GUID seed: new Random(890).Next(9) ✓ verified
Run: Run 39 (seed 1,106,402,812) (seed)
Draw: 100 · predicted N = 18 ✓
Machine boot: 2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1A9C12714EFE4BA5 3547A4F90C17F828 154ED47C92CCD914 775966A66B76D880 892982394D403C6E 2D8173F2D26837B8 7C89E2929E335144 68B3D8A7745BA763 61D559706372F0FF 6D5CADB530841C24 0D7F5576B64CE0A6 7944A706689DA7B3 043F1D79F93755C5 76A329B6B19EA74C ACC2051BACE19610 4BFE575A028482E4 38C1CE773C36EA85 79A5D53E1E41B341 E7A57774BD40E654 D1E24735D0329436 BC4151FE61C54053 91B82A616087BE8F 5EADEE2ECA4BE1DC 5CBE0B506355A96A 3C23EB2CAE57ED77 BAF9B9B62E5593AD 5EF2A064381D65AA D80C30FDB4CEA48B A23B1AD89B8CE4C5 C79D42E64D425FF0 A8E9819655BB1354 25CF0D9CB84FCC32 24C84D47D64E26C9 1967C147AFC488D1 5F2A8588C880DC92 2A3CE972A7A929DF 33AF264893EEF9F5 4D150FE6B8E07898 B8D62689F0F36432 53889A84F2914072 F680DFD272670137 F39D0B5C598BEBAC A64D52B762098AAC 5E9D583024C62752 E487ABE0A1ABC88B 15535E4454BF5C4B C3872CCDAB99B382 594FC19BF8AE5599 C0F3DD477075A16A 90B7724BEEFDABBE 21763A4DA3CE08E4 898841CC45982CFA 3CB2DC9FE81BDB70 70E0FB9C4E3C365B B0A20E44B779D442 7952FC234D5483FD AD23ED84869A1600 0F3F7467BA4EA1F7 0E4E0D66F71C1390 3DC091475C761176 89CFBBA716ECED58 19E10522BB18B2D5 ECCE70EE59BCE882 B7F18625D203D1BF 3574E85E85B442E6 EC911B6A4FD927D5 BA00C20E9AE507C7 95339E17FDB02427 D24C93996058045B D5EAD1A025ABC3BB A5566CDEE99BBAB2 7D7FF1C6ACB5BBA7 6E76F04F31CE8EF4

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201212110700 (name+title). Key = MD5(password) = 80aee708f5f77db8aff6363b64801316, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 243df241-9bd4-6687-b46d-131c6f148c7e
  2 df54ab5e-07f8-85e8-b4d2-1199c0940905
  3 62a61aeb-e432-70c8-a2e7-3a68cde11665
  4 5988f06c-5c31-49e4-b207-f2b796aa9546
  5 c3a4d00a-b5ee-08aa-9c1b-e7edf332ca5e
  6 37934320-156f-295f-913c-d9c81530fe53
  7 5c752ee4-2216-6974-8086-ea15dd3fd6c1
  8 13112294-5e2d-8491-afbb-eaeca3ddd0d5
  9 9c9f8502-3676-019b-8e81-87452d4d71f9
 10 27d69a42-3b81-4262-8028-78338b13cf38
 11 b0da4215-c719-82c9-a09b-5b69875175c4
 12 5c0cdaeb-170b-2c7c-a0ed-b19c4d43231e
 13 3557a316-9660-4f2b-bafe-400cd0bd020f
 14 da158eb3-44c5-49aa-b52a-6420a9eec25d
 15 a329bb5f-7cf9-8d1b-94a3-e919f24b47bb
 16 0bfef753-ec86-756c-a8b2-d0d61705b92c
 17 68f9c5ea-3db9-8fb0-a9a4-ebe0e89137e4
 18 101a5271-f375-7867-84b9-1e8e539b5b98

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 687402680482448787. Exactly this sequence comes out of new Random(890).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 100 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related