201207271430 x9o8e

explained decrypted filler

3DES(name+name) ECB, 9 GUIDs, seed 953

Metadata

Post ID: x9o8e
Title: 201207271430 → 2012-07-27 14:30 on A858's clock
Posted (UTC): 2012-07-27 21:28:23
Timezone: UTC−7 · title 14:30 against posted 21:28 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(953).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 30 · predicted N = 9 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

12B28E4D781972A5 1287033D07B33C5B 0516ED2A73C93C8E 8B2B1859495684FC 88DC61755DA60062 A14FFFCA7AB47F4F 97D069EF4A06EC27 4EFE81BDDE07DF25 C9C3FFD8466E0171 B55B920AC9486104 0C5D41B073398163 3DD801DFCE73905E 7FF93F897A51A04F B818C927DCE947BE 7B8D5D177D9E213C 90A37977676ADE6E 0CF847580434F560 54D34B035D1B6C1F 75B827376271EF6D DA474BA7DCB2D4E0 36BB35391904075B 5498BC463D5254FB 4A6F93A2104C8771 8A54015C8A44E136 263CC842572657F7 C7B2E2EA53C7A87A 869055A37F71CC69 0C25701369849F37 643E716ED92D1D8F BDDB0F74DE140D3F FFF9369DFEAD3F16 976C55C0B426A40D 144FBF0700A80663 1C0839E816B6C229 2F9C0A7797B2A46F AB9B3C230DDAAB4A 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d8d00099-acac-5dc9-bfc5-067f5588bf4e
  2 91fea1fc-a858-4171-ade8-3532ba2c607c
  3 2b12bc60-5351-8098-9980-12a2153889e8
  4 6f82636c-affa-8e02-b8ea-cc5ef00c2ac1
  5 d17599d0-708b-4f91-b182-346623308897
  6 c3c5cd92-85bc-361c-a80a-b81f3c786ac5
  7 198f2971-d737-83f7-8f6e-9b12708709f9
  8 55a1b7d2-82bb-4a3b-82d6-9ec9ce70ccdd
  9 8ac2a12c-e82a-7dca-9dcb-759d9068cff3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 548843847. Exactly this sequence comes out of new Random(953).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 30 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related