201207271419 x9niu

explained decrypted filler

3DES(name+name) ECB, 34 GUIDs, seed 94

Metadata

Post ID: x9niu
Title: 201207271419 → 2012-07-27 14:19 on A858's clock
Posted (UTC): 2012-07-27 21:17:10
Timezone: UTC−7 · title 14:19 against posted 21:17 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 2,192 hex characters · 1,096 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 34
Filler GUID seed: new Random(94).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 19 · predicted N = 34 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

70735FA6713EB807 E007B226F38CA790 997C253A27942D97 8C97383419087FD5 3627D4D56887D66C 87DCC8DB49AD3275 1594A7DBC5C6CA8E 24026537CF442088 D0C486F640EF2BEA 753B65CF96A9C0FB D38F6C2B00CCC175 CD7FDFDE531D1F11 2FEEF284D997383A 51604088A8352935 D09784D15084118F 029C15F443071416 D564650B68714012 803F32032CFBAA55 84793DFBC6D9EA74 928E05316CFD0C01 51565EFE817426B0 3CFA26B22B0CC0F1 B13AE20D289B8F0B FF927AC8DAE81C95 3C0DCC8C913D7344 BC4596EB89FD0355 3D86811FA52F17F6 DC42128BD0AC8975 7D59FBC096AF131E 96E53DEF4BAA44D4 9A78802ACEF13C93 346A447D2445065F 5765C932C21A19B7 E6057982AACBF188 22293E832B9B8EDF 30297C9B4E66D845 A05D90E7DCDFD5FE A50DEC3C0052BC33 C1A890E93BF03377 D2F767E4D8BD2A8F 47D89E50291C2AEC 3D0B46FD5F5F53E8 3A42EAFC0686ECBD DEA20A847A9CA125 F426153798DF0665 99A43180B3D2AE7A 02C96B587D8D03AB 793E99C370400E22 FC1237E60FDB99E6 7C0165900718C22A 8FE593A342D424FC 6A0F712E43A5449B 184E0ECA3C204885 CC3FBF04D8836884 8D78C8B7A961F57F 712DA8A10ECEFE78 D52854D26F7227D9 0A9A7B54406C37C6 944C2D1A2F4B2D36 2717472AB468D5F9 AC6D19B11B845366 2131F155BAB90008 62732413DEB63ED4 2ECE0E214168BE5B 6D703CC7B3D92E34 726AF00FA3D9F4A1 B4E406530608BDB8 7B4D8E28929E043F 039C775A651BDDA0 A317E82CCE2DD50A B20FB35205B29AA4 757B7009DEEFE4CE 2D841902D16AFD35 54F3FAE60BC68BDE A91E3BF9546C0F42 3CD5107135F60E70 34FE135DC6BAEB4B 2568F62C3137EBB1 0A663B33F2BC94D5 B9BCB54519714F18 A55A6FAE935C20BF C239AF21E3E004C6 2519BBB391BB7382 CFA877EF353BF40D CC0D56230ECF13CB A5074D542A08BA78 D8C5498E74D58B6E 3E577E5CD2FEC537 03E4E023E9DE9659 A157202BF8D0AC94 82055D2F437F6ADF DCA80AD8355A04F6 4E153CF8C645EB70 37F00BB0F698AC2F A0CECEE9724B639C 88CD5E85FAADB7E2 E548E7B208F08CC9 A9CB2BBC3A13B912 CD6DAEBA51340CAC 56C3AD6D56329C45 508F24C71B4DE521 EF03AC5B70A77466 FA235786AF594BE2 44337887DD5CE71D 09CB0FBE96871805 6EBA0AAA7722AA81 E62D120C23737472 FA513DECBF8CDB69 915DD40241B7103B 93CFAD45F4E30E68 BDE90011D76B6516 DD71527AE96A6912 65924F9A75237C1E 0883659C11142E6C 00F9000098D45F45 40057D1199443B2E C77940AE4C93C91E EE05BED5F2C59662 8654353707A3B58E 8712526AE20D8BEA 0ADEFB3EB5910E93 2C575FE20266CDEF 567E337E39049910 C23199DA86406358 2C720CD8556D57A3 DB47FCB30416CA77 4E96E8A1DFDDAB9E C98000C81E5851E9 45078193739745B3 A62EC29F8B8B9C43 BF8FC5B1680BD4E0 1F991F6EDB2DE457 B978594D84AFA37C 0C624F580603E60E 43622149771598B9 1F9B522615C3B1BC 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 2,192 hex characters = 1,096 bytes = 137 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 34 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4b8bfb8d-6f3a-7f06-bb8e-f51e63d29443
  2 3a92d4c3-0d66-3cd2-bf3d-8f8df5b6270d
  3 f49461b6-01c6-4510-9520-f2488c7dc12d
  4 082da28b-c253-5f1d-a353-6a898e62b26a
  5 5a12f45a-112d-5381-b5d7-e23a9bb4e8c7
  6 cc2023bc-abe9-6d4d-8f4c-84fcbb54e766
  7 1cbf08c2-b94f-0f45-a0b5-926dd11ba258
  8 e7ec0e68-a62b-502f-8c3e-67f9951f792a
  9 51675c93-8b53-5d1e-b508-545cacd83983
 10 8e350362-89e1-88c2-b1cb-33bd98c93baa
 11 147ab37a-defa-44d2-8363-48140d721a18
 12 a3231092-b2d7-7269-9b07-6084b8538ea7
 13 4d13d0e6-5ced-20d5-bbb4-c87e6472b7da
 14 ebc8e138-4384-30d0-84e4-52a13e2c060a
 15 966924b9-0060-7e97-9670-4731bf993b76
 16 9af02784-b505-6dc6-82af-722bd6a5631c
 17 73dabb24-c20e-33d7-b17b-fdf5e74024d1
 18 4cfb61f1-b569-2def-b83a-8ca71dfdc336
 19 abb65345-b484-1c27-80e8-2b4cfe4f0c1a
 20 f043f66b-d042-6672-8ea0-4e9862e46182
 21 fdd3e0a1-79b6-2234-8ddb-ecbdbb9933be
 22 54a95484-d0ea-80fb-86ff-cbedcdb8d84d
 23 9838c75e-3743-7b23-ab31-daf14c47eaa7
 24 29082959-9490-7400-bc18-c8fbdfdfb3f6
 25 be6d74fe-e2a2-8bbe-8eca-5411f02c07c3
 26 0a71c38b-e637-80dd-a67d-a8d8c6803ca0
 27 ef9fbe48-736a-6fcc-9a4b-581693461533
 28 9dc1a235-cd29-80a6-a5f1-72ed3bcf575a
 29 6c648a9f-7972-46e5-ac50-b23da3f515e9
 30 86808dc5-c89e-77c9-a653-3f05d138db49
 31 0853f570-114e-8ce1-aa2f-d01caea2d257
 32 5332164e-2911-1d41-85fc-abbcbdb4850d
 33 0b514fb1-238d-0f8b-b1c1-ca14045d551c
 34 0b872d38-26ea-31c8-a49d-b504f4dfad48

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7345560558472376321628778868478103. Exactly this sequence comes out of new Random(94).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 34; the post has N = 34 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related