201207271443 x9p0w

explained decrypted filler

3DES(name+name) ECB, 9 GUIDs, seed 813

Metadata

Post ID: x9p0w
Title: 201207271443 → 2012-07-27 14:43 on A858's clock
Posted (UTC): 2012-07-27 21:41:36
Timezone: UTC−7 · title 14:43 against posted 21:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(813).Next(9) ✓ verified
Run: Run 18 (seed 6,051,781) (seed)
Draw: 43 · predicted N = 9 ✓
Machine boot: 2012-07-27 19:15–19:16 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

F7F7A4E7F1F23CD6 85412C962AC9CB73 735B7B2C49D91E3C 33E3A8F7832E7071 835BFF77F81B67B4 4C0E514DA972BCA2 8FB9ACE6AD7C4E0D 3DCC65E142ECC6D1 FA2B6A83422B4053 1B11CBB7B77B9E85 57F3A3ACF46AEC97 B9C6D28AAF823B24 91A571E702DF8A3A 1E0D6755320F7BCB 99BB0FE397442ACE 556806E9462F485E CB303E51B1A5AC38 A4D045954EC6FE78 6849446E2FD5A81D 4D9C65FF20AF4E59 3322EEC3E791E256 169A4BC42FD1691C D1D23A22216963FF 21BC8F9ABD085FC8 68D16979A13473E2 17632F6F0CF0C86F 2A5FC65A1F9E2924 D9335E9C3FE64EED C156F2D642070976 E92EFA10B2212C99 9429C8E78D52EAC0 D4B86B05891B0BC3 A2E54E416C6F4831 1EEAA152267670A2 5BE6688A1C122194 2FA5FE3EB5C9DF6C 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 da97f0e8-6acf-4350-80be-a1ff3ca31180
  2 0928bb12-e2c8-33d9-bf05-e341d78ba971
  3 dad97253-3115-02a8-92d6-8fa0f9e2decb
  4 58010e2d-9f98-0c5b-b19c-cf1e606ec8a1
  5 e04a15a1-1b35-29fd-a42d-8c586156aea3
  6 5e7fc4b0-83dc-0a9b-9d59-bb81455c9d59
  7 8c7ce7a5-f312-169d-91f1-8e85d9cff36c
  8 98d6be0f-b41a-2b99-b629-18fab810e1bb
  9 bfa77bd6-07f5-56db-9b72-0d3d0d8e1d02

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 430020125. Exactly this sequence comes out of new Random(813).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 43 of Run 18 (seed 6,051,781): new Random(6051781), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:15–19:16).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related