201208011913 xjhh5

explained decrypted filler

3DES(name+name) ECB, 10 GUIDs, seed 273

Metadata

Post ID: xjhh5
Title: 201208011913 → 2012-08-01 19:13 on A858's clock
Posted (UTC): 2012-08-02 02:10:38
Timezone: UTC−7 · title 19:13 against posted 02:10 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(273).Next(9) ✓ verified
Run: Run 21 (seed 452,527,359) (seed)
Draw: 5 · predicted N = 10 ✓
Machine boot: 2012-07-27 18:58–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

3F447D9C4C83594E 8293430066068F9E F3EE298002A2DF3B 2FAB1918369F3205 CC6803E34CAFF7DC 6987016B1BE03643 0872D7B5DD3CCA4A 8820D8AABFD2E350 3982B9DDC5D1EBAE 967556330D16B68B 04AD53DB2BD4CE20 017D19726B69B3B2 68D81DF34B3EE9E8 577C74B990FCCB33 6CDF69D0A3D2C702 D5B1A6372CE51AD0 69810C5AE9CF9ABE 1993C38C311A477B F64FE2092D910986 7CCB6A54427EFF63 BFA832BD2060EF99 B97356593FF8B310 D289191E32B5698A 09A1090256267F68 5E50E68CA823DF8A 90712A2384581457 C51DA1966AF40BF4 3AC3DB9E2709FA25 E90229B80BBA13F1 11C83269AEA0F452 7743299043AD2ACF 42A2C8C07634F4C3 85919EC005143E4C 884F9A3E73BC0585 6BB70D11C62897DC 80C6AC0E7C487EF0 1BCFFF8B8B6FC8E0 B2C75C4644577AF3 BC503B77E2EB45E1 51CB93F6D218A156 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b4a2813b-1462-33cd-823c-e5b894b198a6
  2 6b76ff75-520a-8876-9ae0-4f8838486cdf
  3 56423439-1b3c-5fdc-8bfd-2228becb059d
  4 cf7e1edf-c002-727b-9a05-dbb2bb6ed3d7
  5 70d3516c-b058-4d99-9d46-d130ba4f2c9a
  6 ca8e74e7-2efa-184c-9058-94b09460edf6
  7 4432022b-93e9-247a-a932-a72b82c7f7cc
  8 0ed8a138-c461-3dd3-9f06-24fb392b63f0
  9 fead9f62-995e-675f-a35b-d2c6cf63ed35
 10 b8d9e180-fc93-8fc0-b0a6-fcbca1842a21

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3857412368. Exactly this sequence comes out of new Random(273).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 21 (seed 452,527,359): new Random(452527359), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 18:58–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related