201207271417 x9nei

explained decrypted filler

3DES(name+name) ECB, 15 GUIDs, seed 500

Metadata

Post ID: x9nei
Title: 201207271417 → 2012-07-27 14:17 on A858's clock
Posted (UTC): 2012-07-27 21:15:08
Timezone: UTC−7 · title 14:17 against posted 21:15 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(500).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 17 · predicted N = 15 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

8904F53A3D98716E 9474620E2DA3DDD1 6639CBF7D11DA00D AD4F27956756D9A2 1C34AE3CC39E24DF 7B6641EEAED00611 738311055C3DE099 E43EC5ABAA38ED2F 5968A5E7DF40A5BA 99CDA7E9F8CAC1D7 757DE9BFC8993ACC 4E7703BF85BD81B0 0415C07385FB0D8B 0DA2AC8B21F828AD 0D903D9D5E716DE4 810DF9B032BB3D51 D6A211C73C0C5F8D D16497861547217A 5CC531396EA2FC52 4095D28EF316281B E55F5153763FBA2F ACD067C5B34AE2E7 784CA57270DEBE7D 836D9B75077206E1 706356E61566FF14 D0FD602FE72CA8B6 422758F40CE5EB2B 9537F48835DEB5C6 39938DF9D3039FEE 88DFC6BC6A85F1E4 96CEE9DC2A09F15E 87B43BE7A90832D8 0FEF29B6CABE08EC 202F79BA14B65660 70FCD02ADA5530B9 2402D780BBF15455 2F895A012CE532DC 0E86F86E709F3944 A984D7AE8EC046F3 532ECC9923ED030E 53FB4D8E7F9CE147 2337E66EF51A4A92 D082D4D0B7B4193E 20210353F938CF35 149EA3FE98FAEC19 53708FF3BC036061 5975DDD290B4DF12 41B06CB2162E2B08 964EAFBF1D093D9E 8B009A1AC445129B 811F5AA0788036BC 7DD2120CD892229E 94516FF1C35B2456 5247BDFF94D13480 0440C5B4890EE6DC A76B1DE47600FF8D 5D43059EB874C2B6 E3CBDD660D5071CD 181DCFB1FE263097 AC184D1EA6A0191D 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f0c9ef72-17ee-839a-982f-591f5f108a0a
  2 bf70e937-2b31-4d12-8587-33a8e99a6a35
  3 41e0b663-65d0-28b3-95d5-3ce3ced0e496
  4 cbe4588a-0e14-24fd-b532-5c2e0f2f166f
  5 ce2942ed-30d6-8f06-a325-56892ab36c95
  6 bf81bc30-4e14-42ea-8e8a-1591affdfdaa
  7 aa22cbea-8083-812a-acb2-0c7d27aed385
  8 f55abb49-a14d-208c-a614-f234eaaf8d86
  9 4957d21a-3835-7488-ab38-3118c65aa6a5
 10 3609ece1-8ce4-5842-a643-dd8605a560ab
 11 1f8053e6-be94-500c-a8ec-8baebaa9366c
 12 83e19bfb-c849-7a52-89dc-8bf56978ce4b
 13 7b7d52da-28ed-3937-95c1-6fea7d139a28
 14 1065bfba-da8e-5f6d-9a4e-cc7483c7809f
 15 762b392f-ef45-89e0-8313-194d02735f77

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 842284827557358. Exactly this sequence comes out of new Random(500).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 17 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related