201207271404 x9mmh

explained decrypted filler

3DES(name+name) ECB, 9 GUIDs, seed 578

Metadata

Post ID: x9mmh
Title: 201207271404 → 2012-07-27 14:04 on A858's clock
Posted (UTC): 2012-07-27 21:01:52
Timezone: UTC−7 · title 14:04 against posted 21:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(578).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 4 · predicted N = 9 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

6E2788D069D69134 06C85ED9E8DA40B4 2FB96ADA1A508072 D6309571DA7EE8FD EC65CC1C1F03ED01 F7849EB381639209 CD2C5244FD2F99B7 FD7AA456C399BCFA D079A3B905B3E9A9 F81D95EBEA60E83E 1CEF150C3686884C F584AFBB4B3C25F9 DE33AD18C1EC93DB D82C4B11C75316A9 33A21FFE3C2E8C15 690D48584B7B9638 5AC9E75CEC992A5E 7A9BCB3A835E0463 C4A4C1CF487100BC D49707C2A99B765E 26608DEC8C2465A5 FD7BB73E0200239F 5119C427643AB76D 009691C79C97967C FB27BCE3960223E0 3A70C81B6E72C10F CF19454F0FC49A38 3A1A6A8A7AD3BFAB 94EE3142B4C209BB 720D2140E2CBDB2B 1BECCF9CFB4A5235 BAC141C0FFED3135 0F117765EECD4F1E C02E9AC05996F3C7 3799C61D340861DD 2283948A6D660BDA 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9e58582b-9f47-688d-9ad6-ba4bfd1717b9
  2 00deecfa-1cb0-3fd6-b95d-bae38fd8d87f
  3 c949a823-0d06-7306-acf9-8e680cfe420f
  4 c271190a-5688-8e69-b439-9f22083ae2cb
  5 c9905db9-5a47-1845-87d4-3945e37dd4e7
  6 f72ffd51-2d1d-6e31-a262-4732240c93f5
  7 fba20e63-ee1b-73c2-9b50-2089fec8453d
  8 7c545b93-2133-3ceb-8f02-9eebd94ca35f
  9 71bb0eb7-cc91-442c-9131-4b5941760778

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 637816734. Exactly this sequence comes out of new Random(578).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related