201207271408 x9mur

explained decrypted filler

3DES(name+name) ECB, 27 GUIDs, seed 750

Metadata

Post ID: x9mur
Title: 201207271408 → 2012-07-27 14:08 on A858's clock
Posted (UTC): 2012-07-27 21:05:57
Timezone: UTC−7 · title 14:08 against posted 21:05 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,744 hex characters · 872 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 27
Filler GUID seed: new Random(750).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 8 · predicted N = 27 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

ECB2C8842FBE2417 F8E061A61B70F17E 89E003E38D86DEAE 6505F919F68C0D66 29C473822ACF7D97 1CBB174376618C6D 607BF870D9C7AC2F F415AE7B2CA98A54 B00E6FFDE99E4C64 1B1FF3BDF945A74E 4824A813D6CB05CB AE93201D9D619315 855F5E7791AE0D83 6BFA4CD6BB5D6AF5 E0F70BA361518ABD DFAA8335C0DAB180 1FE11361CB5D3B7A 4E9B9B139DF0697E 100FD8A850B757C5 0311F809BF052462 4D697BA9EC51733D 4AA4F19E5873CB8C 118D606F388A1ACD BA79D50C4329DD85 4578F0F222671F2B 7B8D7BC7CAE4A3B5 826BACAE86CEBBE3 36C92BA1872F4588 97898C60CEDAE45A 46BDAF48FA7AE77E D88295D9564F88AF D5C05D1865C38959 3842F1A8BA4AE911 BF2738196C9D399C 0412B9453128090F 852B9BEB641F0E09 3FAAAC831EF03680 0C3A048473D23F3D 560B878D4794CC1D E340F6ECE3D1C2A3 4570FA0DAC782683 9F92FE6370A83722 62BBEFF1670CC2EE 4925357748BE4E23 68643B8067336145 1B70644382E63EC5 57D6DB00937497B4 840E73B580D0E3ED BBCE810CF94FAD84 C255DE20E9A4B57E 371992F685145A4D A80E46F590992EE7 73D83CF2A9045702 3406CDFD8FBC11F5 E45A92854FC44E5C B6531D80D165D0D1 8871117DEC8AD840 A657A98FA98653DF 14A9270A5F785EA1 C6B10655614799F5 C02C81A960C86D8B AA5B62C5E2ECF6C2 CC131E8831B046AB 2CC7426860FB7224 838FCB86E1F1E4E4 25EBECE7DA85BF9F 26302D5A715438C9 CA4359F7D9BA30A7 2ECBA0A243C3C8F8 B6E4C868B99D1C3C 1C8C5CB8EA172F68 CB80B7B43789D7F9 11645CA969CF1C2D 9037A4010DCED5F2 3590B9759536E360 EC6F44DA74674387 C6ABE855CC7CAB80 D6F66928482BB68C 29B0EAA13E554D3A 936484CE7D82D11E 29C879D7228B6F05 17C6E75CF40F675C 7E1D99482A020C8B 2970E08CE1F1812E 486AA71F6EAE498A 0B0B1FA4458A7CF3 0B516633FAEAF57D 1B599E2CEF2A0A72 0020C2B3FF49C5F7 720B76361BADDF1D 41D857BC8133B697 C3A056BFD012A3DE 87222E0E2B65C133 86B9D482FE538BE6 7F63358F9B36ECC2 5CB91CE9B9FD7015 B935D1544E23EA62 A30E9E71092E4A87 61F34CDB88C8035F B35F5E8F7ED7632C DC3DB8DEBB3BC4AE 1A301DEE744A27F2 21BCF17275D280C6 C2C550B849D3B0B5 C78CCD8A3A6B3974 F5417F8200D9F847 3F5345DF3E215344 82EE43134868751F 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,744 hex characters = 872 bytes = 109 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 27 GUIDs as hex (shown below).

Decrypted: GUID list

  1 94704b36-3b73-45df-b153-61c1ae1f0c17
  2 db088fcc-6939-74a8-84e2-fd17d5c61024
  3 c5c1e946-76a5-04b6-ba13-106117733c88
  4 4b92399c-3f0d-59fc-8c3c-04e6790d6223
  5 153702c0-172d-76fd-86b5-92551018973c
  6 26a20ef7-52d3-86f0-bf15-4f3529f25944
  7 ee9872d5-c77e-8abe-8d60-ed015538fc9c
  8 d3e0469f-a06e-6e8d-8ac4-64da42972fe9
  9 693da0b0-418b-63a3-8a4f-556a60e2d63c
 10 8b7c401d-083e-768f-8d95-1503ff02c742
 11 23ca2240-5ac3-7006-9acc-bfa9b68b35b3
 12 5cb78143-2193-0840-89b5-c0633c8d69e5
 13 03d4869d-5741-1c56-8635-04f12e32c6a7
 14 4cb89b7b-6821-576a-9978-80bcff759ecc
 15 1446260b-ff0d-8ae6-b624-7aa5e849e09b
 16 99c186bb-8df4-39d3-9b42-af5670f78405
 17 ec9224df-35a9-1296-ba25-861e3e159907
 18 a48e1b45-608c-823d-8dd2-bc0646a14e32
 19 18c67bf7-debe-8126-b99f-e665c96c0a04
 20 666fa09f-f4e7-691f-bbce-e00e8f51f4fc
 21 20b23700-7e53-4b10-9033-7aa8e8de924f
 22 145454cf-970f-76f4-a192-ef9d2d019040
 23 d296aec2-3edc-6f50-9836-fc4423e725a3
 24 c9e7e0a6-5343-0173-88a3-3ee12c1d84a6
 25 63d18d2b-7d55-133e-98cb-6702240baec3
 26 c8cea72d-3f44-8143-980b-c885eaa3687e
 27 251f15a1-53ed-6637-b8a8-6976748b2c99

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 470578866770158318864760186. Exactly this sequence comes out of new Random(750).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 27; the post has N = 27 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related