201207271409 x9mwz

explained decrypted filler

3DES(name+name) ECB, 16 GUIDs, seed 641

Metadata

Post ID: x9mwz
Title: 201207271409 → 2012-07-27 14:09 on A858's clock
Posted (UTC): 2012-07-27 21:07:01
Timezone: UTC−7 · title 14:09 against posted 21:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(641).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 9 · predicted N = 16 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

8EA7DB5C13ACFE4E 1A9789173D9C2FD8 B0FD55D934C4A153 ED0EF8F1CA303DC5 B2CF92FD012352F1 F20FA1B6B43BB217 9312CD8D69579C55 ED0F0AE0CDFE9380 C31FF70236786729 63B53838F0730BF8 A41FF2B63A7DA49E 2FD16D23B0F91820 7847594641C4A3F0 0DE76B89016844FE 3B20FBF4922C5C41 EB880CF655DF0B2D ED76D68A45FB2E99 C05465C35E0A9199 8637F98D1B56CBA2 88E75B4C229D004B 1F56723E5A967834 0D47B9466DF0AF4C 7EE64A00C651B5FE EC46914BE81760FC FE79547D91F85FA5 E52C6864DBAC9606 33980668AC59C7C9 DA15272B02F6F738 65D92206096FA0DC 04B11AC77AA257FE 259F20DDF4F27F13 79CEB528FAB02E84 41125807D1FC4877 A8C2FB2321EFD9D3 426A6A467FDEE06E 1474E384B09A3764 5C7EA79F231A1FB9 3932440651A8DB39 9D61F1153BB1BB89 596978FFE41BF376 F9D63C8EB59C5BEA BBA3C91CD8658A13 F81DEDAC585B165E DFBFC546BECAA540 44D440F6E33EE9B9 9D78802082C66243 67F6A9BBA481D2F1 ABCED082F3B944F8 3EB812CDC3BC4642 95F5ECE5A0D5AB5A FA0233811BD70C6B 81B5809080C0D8DF 466EA2C972F95FE3 808CF07DF4F2673F 123A6739683963D1 D6BD0F58E3C84E6A 6F1BC1602690472B AA644A2D540DD2F1 4D7EAE3255B68A4C 2DF8A9DCF70E943C 30615665B92270BE 18835633CCC3CB76 4182D2CB0EB51605 FE83F4CFE6CEB51B 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 63a447d6-60fb-5617-b1ac-b102f02e2367
  2 03836ca9-7297-86bc-bc1a-3c467c45e684
  3 5f5dfd2c-a74c-7a79-ac2d-05cf11823c6b
  4 63852ddc-ff9f-341f-9390-6702438a3322
  5 7115e007-5112-5f11-abf0-7cee58111c7c
  6 9c4729bd-e70f-642c-8a2c-3121879b0d02
  7 19d839f4-63ec-0efa-b6dc-7a2dcc41235a
  8 77312971-263d-035a-81e9-e1cdd65bcc30
  9 30add9ba-4890-2aca-8a34-f92c33304ac7
 10 ec0cf722-208f-5c11-8297-852768335c0f
 11 5e130fc3-b62b-4f0d-971c-5d06837d24fe
 12 dd13e4cc-0fbd-8a93-ad8d-ec3d5026bcce
 13 514f2bd4-492a-2815-88aa-edcf16d7c5e5
 14 b9c61caf-3a8c-8996-9d27-9536e817a1c6
 15 9585eb9a-5aa5-5aa3-a502-315d4b00c465
 16 95c72f79-95a7-3f50-b4bb-e901a96ff966

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5873560025482853. Exactly this sequence comes out of new Random(641).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related