201207271410 x9mzj

explained decrypted filler

3DES(name+name) ECB, 13 GUIDs, seed 703

Metadata

Post ID: x9mzj
Title: 201207271410 → 2012-07-27 14:10 on A858's clock
Posted (UTC): 2012-07-27 21:08:02
Timezone: UTC−7 · title 14:10 against posted 21:08 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(703).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 10 · predicted N = 13 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

423E3975C2CD21BB 53CBC57FA0E46BE7 FBD44C34D596F9BD 4F4216644E917595 BB53BA16B4BFAF43 2937D87EA375B86E 38D9533924C9F82E 79115F4AE0300506 83E979583F72F4A7 69F7C0A7AC741EA0 7EA02AF178C1C7BF 4DD7FA54FD8A9F52 1189849ED2FD96DF 2A18E119E1E41C9C 6AE764A7EC9ABEC2 97257823BE60F0BD C3F3197CAFFFA6A5 89EB6204270DF4B5 7957EFAA9E7B0355 9316FD252CFE465A 9AAFE59B9C1CC5D9 D922D98624B38FE1 EDC72826BE18D712 A4AA6B9C05EC1F26 BB2A2036E5E4EDBC 4E3EA1644E435CEA 1D50CEA19756438C 9E0CB0022318F5AE 59BA0B098641EAE5 4ECE860F3163E250 AE5E34279804F1E7 431655D927A41D8D 4B59AF1A0E899B8D A0C3FC4F50673B28 DC4A696A804B85C3 B8DD9F6E2FA7F107 C4EDB9B841D4001E 84D6D81CD92D58C5 E5CE981C47B9A7AC E785A3A19A75AD7F 75826C2D2A877B60 6C10005745F3B643 9F5FABDDE393B227 AFF8345DA531A192 6A2F6E90630DCA0D 5EF319DEBA9F4DB9 91936F899AF64C71 9A688B0874CE0EAF 849B87998F8C58CC 119A2C89858E9F6B BCF0DD02DCA42D36 5706196C38A57642 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e9e60e6b-36f7-80c3-9b89-b373085a5eb5
  2 107c5850-148f-01dd-86e5-d5d162282aeb
  3 78ba3e1b-91b3-180e-a9b9-510770979f19
  4 42c10130-479f-54ff-a450-53ec05df5bc6
  5 a796b27f-03f9-52e5-a9ad-a3de2c3fdafc
  6 292f0e12-e2a7-81cb-9ac8-eecbdc790339
  7 aeed20dd-b33e-8ab8-830a-324ef29089e1
  8 ab5a6eb3-958f-1b85-8f39-91e034bfadfa
  9 28beeff7-2719-811c-a4bc-41c946e9b85b
 10 fcae9d63-8809-43e9-9741-acc7c1c77a38
 11 27154ac7-3808-1679-a3fe-c7f933a7a439
 12 a3689a4e-c3ff-2dc0-a8d7-8a7efec1a602
 13 0ae4a127-e007-8d50-a3af-2cf3069c3da9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8015588184128. Exactly this sequence comes out of new Random(703).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related