201207302342 xfi8u

explained decrypted filler

3DES(name+name) ECB, 13 GUIDs, seed 230

Metadata

Post ID: xfi8u
Title: 201207302342 → 2012-07-30 23:42 on A858's clock
Posted (UTC): 2012-07-31 03:39:38
Timezone: UTC−4 · title 23:42 against posted 03:39 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(230).Next(9) ✓ verified
Run: Run 20 (seed 267,961,078) (seed)
Draw: 0 · predicted N = 13 ✓
Machine boot: ambiguous: 2012-07-27 ~21:13 or F 06-14 12:54 (probable run, 6 posts) (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

1F5A58B84E24C215 1C3FFDC400BE740D BD7207904DFCD910 31C1A19697D0675C 524D5B6DBF1B3F6C 1829D7F061081D44 DF026C229CC52BB9 75E60A4E97D7D967 BBC508BDAFDD9EA1 C7EAB8D9D73923DB E380F1CA7A0E2D0E 68AD2C2255158F1A C5F31322D334C81B A224BD8D2FDE94D9 B7FEA33A9C666255 2F6F71AD2D316216 8D7854757D260E4B 5289F42BB406BE82 3A82CF7E0FD47E1A 6850C1B1684FB063 A15A925F0B2DB8CD D6B9BF3373EA7C97 414983F1B06ABE89 1837F2209F28A258 68491F5CAA6696D8 F8243B7870E8CB7E 9F8D5C200FBA0FB1 FD9E1D05A27F1068 8ADFED6A96A2E5DD 7C3B1813CFF1ECC8 539CEEF3237C0CF6 CCAD9FAE694BD207 2870853D918AC47B E393CB4DF5641512 C5604B53E7797620 841FD3655BD6A2D9 C45C87E55455FFBE D24BFCF1BE067D89 BFC208882FBFBD96 B20C8E42A9304C42 859936AADE9A792A A76D403557CAC751 60BE72EFE288BA94 453A4E5CB2104D8B 32934C743A8F31A7 E53280B01A3FD89B 44924C703EAEFC92 637488BA50A4195D E8BEF3F22A6156C9 84CB56E66217F485 3E466590474E2DA6 EB58CC016231C966 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8013006b-9877-7ffc-a1f5-a6145f0b5961
  2 81849b66-777d-2b49-8782-cc0bb247e20f
  3 1fa81332-0df7-4a55-9bd8-c5cd98c487cc
  4 194d49a1-9d5f-5411-b7b3-6076cd4e6cee
  5 860ecb12-7df8-013b-9b74-ab49aae8b5aa
  6 fecb8270-971c-4c65-906a-d5b36b643490
  7 e7d63a8e-8b54-86b6-a4ee-316eb6d04df0
  8 7a201d2c-8b9e-7127-8124-b0378c7820a8
  9 6d5b86da-adf5-3ea0-a463-cbd86c39cbc6
 10 8b23fb4d-6b63-09c9-b9b1-9f6fef2da9fb
 11 daf24070-caa1-6f34-8648-07443aaa8509
 12 9f865b5a-fd12-0bc7-8d5b-40ae1a9201b6
 13 a7bc9195-345e-6b79-91df-8444810a05d6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7245048730606. Exactly this sequence comes out of new Random(230).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 20 (seed 267,961,078): new Random(267961078), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot ambiguous: 2012-07-27 ~21:13 or F 06-14 12:54 (probable run, 6 posts)).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related