201208011828 xjeq9

explained decrypted filler

3DES(name+name) ECB, 12 GUIDs, seed 226

Metadata

Post ID: xjeq9
Title: 201208011828 → 2012-08-01 18:28 on A858's clock
Posted (UTC): 2012-08-02 01:25:36
Timezone: UTC−7 · title 18:28 against posted 01:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(226).Next(9) ✓ verified
Run: Run 21 (seed 452,527,359) (seed)
Draw: 2 · predicted N = 12 ✓
Machine boot: 2012-07-27 18:58–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

A492377760E50244 1E2EE00841C0F6DF D0A049E4F8E18FA8 4C8B4BB6490CC6BF 4FA2BCD3DEF83FC9 2E10DF2EBFCCDE13 CA24D8CE46E246FC 86255D72062A1F26 860C586D891FF145 ACE78C748BB8C8B6 55BDBCD02574363D F0D146493C623130 3EC4C882159DCFB0 F516A93E71DAA85D 922BA65D4C951890 B343B24CAE879161 26A07903E846CBDB 0442CEAD927F2D94 05027E42900F22D7 8711B9293287A5E3 7544C44EBCDC385B 6843803539FC97CB 1C8B93F7F5153DDC 4BC369C21E665BA0 F3C76CAA0FBB27E2 78F8F7BD2EBA3C1A 4686CC33FAA17A76 A2DAC87EF7FD3CB5 B3C7CD752266CFE1 728F1F4A97A224F1 A3B0EA434FAB12DA 0E1A762845335F04 5C8932CEE8FFA63F C766D5A40C64C200 8E8E4F8460FB3986 3FBD69AD47FAB674 C08985038FBBFD74 9E5470E2A0085359 07C90520E0D69D4C C942B01EDC0AA17A C3541027EB9E843D 978BC8590EFA32D0 11B3F6E42A9B59F2 BC68EC06227723E1 C5FD356EDF6D74A8 2043C614C5CDAB50 05797FD83FD09CF1 A78D7069774C91B1 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e788e424-335d-7cc0-83b0-14288df45ec2
  2 d7b76f00-690c-1d32-a205-a9fb3f4072fd
  3 25b3c0aa-dbe5-636b-ac78-b98b6b7df463
  4 52a374b2-ee26-76c5-a3ad-d12d37d5db80
  5 a9fea511-126b-2402-987e-ebbf017d9d2a
  6 a645389b-9e5c-0ad5-9a49-dcfed8ffc039
  7 b5efe57a-26ab-1eb1-b09d-aa6a56e92295
  8 35a8db53-dc48-7031-a2da-72c0ba95846e
  9 f1064a38-a0e8-88af-8016-c7a7969cf544
 10 9905279f-e86a-54c0-9870-4346e2a573e2
 11 c73f2424-0ab4-73ca-86db-481dd537afb3
 12 a82c6f66-489b-8d6a-8bd7-98e4a4ff8ad5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 716720178578. Exactly this sequence comes out of new Random(226).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 2 of Run 21 (seed 452,527,359): new Random(452527359), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 18:58–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related