201207271401 x9mg1

explained decrypted filler

3DES(name+name) ECB, 9 GUIDs, seed 453

Metadata

Post ID: x9mg1
Title: 201207271401 → 2012-07-27 14:01 on A858's clock
Posted (UTC): 2012-07-27 20:58:41
Timezone: UTC−7 · title 14:01 against posted 20:58 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(453).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 1 · predicted N = 9 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

3478451A875D20D5 6FCD7C5DBD0B1B95 B6976DCF88805877 55E27C3FEC3AD419 544AFB1C24D68C13 99559BC58EFB26A4 36CBCE718C06058D DCF9A26044145F34 49A8BDE182CDB9F1 9E789BDEEA49F85F 304673030AF861EA 0FF1385F4A3F203D 84FFFA4443100291 DB8B4E3114480913 B1F8FED58FE36918 367092675E5CE0F7 84FA6E759CA48BF1 CE8FC6004D8BFF95 728179A43FA2EE89 A523644E8EF5C273 572829504ACEB5FB E3CF4F1DB72508ED 532B3EE067BEEE6A 69C24C7876505EF0 308AECF00BD35BD3 B1DB1675A5AB5D76 E13D453DA1E69538 9809B69DB1F612A6 C56A861EAF588BBB 2657ACB9CC0E5072 B7684D08EB1DD3BD 7F45EC1BBD62FAC9 4685055FA533C9E2 1277D22093B6EAAE 948B7A104C97A604 BBEEAC3BC361BCC0 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1eb2387e-79b7-3f14-bda4-ac5e32c5a821
  2 4c38f455-0b99-6679-a5f4-6357ebd0f300
  3 97b8fde7-153b-3ad7-8c9d-ac9cbee8d2d9
  4 bb665f20-e717-295e-914e-4632d1a43664
  5 e4be0d3c-340a-601c-8c0b-5be549f93ace
  6 06092d84-4571-355f-9ea8-8c38ee3dae03
  7 827150f1-278f-7ddb-9cda-4a02846bbda9
  8 836ec7c6-bb9a-6430-88f9-5621ab11f659
  9 ec2e245b-a287-01c6-a973-023003cc88a3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 363263760. Exactly this sequence comes out of new Random(453).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related