201207271428 x9o40

explained decrypted filler

3DES(name+name) ECB, 14 GUIDs, seed 297

Metadata

Post ID: x9o40
Title: 201207271428 → 2012-07-27 14:28 on A858's clock
Posted (UTC): 2012-07-27 21:26:22
Timezone: UTC−7 · title 14:28 against posted 21:26 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(297).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 28 · predicted N = 14 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

BF728F863A5577DB FCDBEAD42D98B0F0 5FB20ED6EA10D610 D18C6C16FB104A3C 85342931FCEC4BA0 4AD3A99A5C1ADDD7 7232F03DD4F6DC24 788B692C18B0A56C 600ECF7A2DB4A9BD 705D2EB305E1BA3E F24D3FE8C616C3C4 B9DF117D61AFF183 BA7F4E23951A56A3 936F1D4907AD9039 7548FB525176418B A57A59301CE4DBAD 41291D748F0EAF5E 23AEB014946C8307 10DB448222989EB7 F54B7F3895D4B652 9D6F67C2B925FE61 7F13606833CC6016 0250F25393765D88 83A5586FDD4AFE75 5A007CCB017F3353 7F2DAD63EAB8CC15 019F71C7F209EDB7 B1584B3A1ABDA715 2A90C01DED291A94 AA7C18C0B4ECB291 84837DB2148EB8E5 CA4796549D333BB0 F31EEE429A2789EC 5611EC224C004CD4 231E0863F6B257E9 12AFD5C384EC573A 1DE8E607F30570B6 98FE250E199C61E5 114764C07479F2C6 8B07422C11AFE838 3872C15B3084BDCD 3B20C177E71DC908 C73DF027C5E00CBB DE6FA94BF1C91E47 7D27C9A56FDE0114 A94EE53B98D7DFC0 8C7319607BA63E7C 16BDCC003BA40D86 F024DF69E6A2F05F 575157896AE07EC4 012DC00D3D9B868C 4646455532678A81 8AC10197CD6C820F D313FA7563E01A70 50DCC6ACEEC46579 98565E8AE9DAB778 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bd5c046c-930d-76c8-bcb2-f67d0a78621c
  2 54e1497e-d4d3-848a-9a4a-813992dc62a8
  3 4e5b55d6-45a8-3423-81c3-349f22f86bfd
  4 303eecd9-e092-83ca-8c1d-d89ddbe9d754
  5 bef38f7c-0c35-2424-8e91-4ec307e30695
  6 5d783920-2be4-0a56-810e-e2a680d1661b
  7 34a1ae6a-511c-89ae-a45f-228fb116c381
  8 6d80f8d8-c85e-31df-92e6-c781f096385b
  9 2a026564-a49d-6902-8805-9cb594ce2666
 10 20a76515-8aac-705b-a229-7fc40eba0099
 11 8ba01280-28c6-0df8-b0c6-06ed8d26d937
 12 acfc9425-f1c0-347e-ac0b-fe524dfb41e7
 13 75f5fc2b-a38d-71d5-a4e8-65d8da4f392c
 14 fd38288b-bb18-8529-8137-42253ec009a4

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 78382083670378. Exactly this sequence comes out of new Random(297).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 28 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related