201208011943 xjjcm

explained decrypted filler

seed 773

Metadata

Post ID: xjjcm
Title: 201208011943 → 2012-08-01 19:43 on A858's clock
Posted (UTC): 2012-08-02 02:40:40
Timezone: UTC−7 · title 19:43 against posted 02:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 24
Filler GUID seed: new Random(773).Next(9) ✓ verified
Run: Run 21 (seed 452,527,359) (seed)
Draw: 7 · predicted N = 24 ✓
Machine boot: 2012-07-27 18:58–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

0E63D8381E7671CD ED9E78668CC000F1 A65D6C5ADB0D2E5F 9F15EABFABA29DA3 788504D33E71D578 F1031B411D62236E 42D476F46F5D5F3C B40A8D92C19255D2 0A60E7001018D72C 5E75BE0074232A54 B08333269C662BC0 B7C3296B649E044C C601D526084B37C5 1F8B2E52D213E516 AC5297E87B8699B6 2D23ACD6A201FC71 93AB8E4291540407 AB530F6275BAEFD8 7565C2FB5B773837 6D5CCA7A6758DB9B 12662A71A43DB9CC 53B35D88C527022A 0D5FCC364B8F18FD 9ADBBEDFEEDD9692 239F1C9C6B51E768 582A0F33C55F5CD0 50C7D5967760AB47 41C21FCF136E9209 86B918B4D9C4BB61 8DCCF2E7F5B57541 08BE6F1C8FCC1F6C E767896313EA005C 814B4031FEE2899C C8B64233728488A1 EEE5F0B2C449FF2F 7CF8691AE46A44D2 7F1D08B404914CCE 55FC8813C274ECB2 D754B30F3B314DD0 1359101517D202C9 DE92E8BF175719AB 1BAFEEB13CBDB701 1B001E8F9221BA09 9691E97D762FEB21 A52611953799E771 C29BAE2229A5C423 FFC2DA09DAC9C5EA 543FC767B82358F5 3F79AED1B65005F0 E392D9149DF94282 46C5D6E531DB4638 F6FE3982EDA67592 15236B909652EAB9 6096594D2FA387C3 5CC78712BB7EA974 D9E848ED34CF560D C7CA2AB7A434397E 34376F6FFB954BA3 EC59FFCF4C9339D6 70E07F9CFE0FAE44 ED9DB57199F16838 C14ABAC041F4F32E BB9A9C391C43C694 B02D007FADF2A87A 720F6C5F767D2E16 D243677504867211 2F736B8E9C8D7D3F 670E4334050D94EB 8D7CB3263FB0FD36 FF44844E8F0686AC 843888DE7EEF0E8C 39622D42B6F47D60 F6EB045570235C4D 10B5CA68EA4793EE 945AA874264C721F 6554538457A0B809 F1C138AB68FAC7F2 E57173E4A9499991 4D6D83C918974898 FE056DBDB489BD9C 96E4AA51309B3280 5E1990495604BC67 BB73DA79D3EBDEE4 985DD173B689B36E B8B745A5E03892F3 86CB9C70A70DB494 A5B27657D07F296E BE4E35C70A990151 9BFA2AB4ABB73AF6 DC6038FEF810E233 AB7900FE56834A82 5D00AF3331447ECD AB8FF631956D1EFC 790E577D4FCAEAC4 7DB76C4E80080D82 57EAA41DB81347C3 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fd8a3314-cc03-58e2-aca3-e118fe8d3892
  2 fb73e4e4-c0d2-5393-8d70-e7b06a6eb289
  3 dfb92797-26d7-0421-8f32-a85ea02ea5e5
  4 8c13703a-e907-4421-9b8b-66b8ab904d2c
  5 8378e2cd-0cf0-14d0-b57f-d936aa5fe00a
  6 26935501-77aa-0d44-b205-5d01915fbcff
  7 c12c504b-8f41-2d08-b949-df140bfe25f1
  8 e6b73495-1cca-2d41-8a76-54536ac8ef61
  9 0b871bb9-0655-5a61-9175-83df40008b15
 10 ced6518f-cf59-2a4d-b18f-b6c0159426a8
 11 0c0962e9-0f57-7338-a2f3-87bfc8995ad0
 12 08dfed85-dc37-876d-8df8-323da6fe9386
 13 2f7c5421-f612-0c9c-b248-06f3c1f98e64
 14 1239e1e8-f0f8-5903-95ee-544ebcfb72b2
 15 94c9eb46-0d84-0cbb-8010-eeec2afd10a0
 16 e21a7e3f-0166-79b2-bd25-1680581ff309
 17 3b0fb1c2-35ab-748c-9557-db026bdbc8d9
 18 1b6cea31-a86e-23a6-833e-de9063717157
 19 742d9f37-86ad-5538-a231-d9d5fee22525
 20 674e2c24-e418-59dc-91ae-f406e4f9d3c0
 21 bcc11bce-c5eb-4695-a2f2-f0ac2dbc60c3
 22 a55c98c6-bd9c-41fc-8152-27ec99c1edb1
 23 b65ba7d0-a700-5af8-8ea2-0fe9d309dcc6
 24 e5ffbdb6-d652-0bb0-b420-1a3923530eea

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 550410225278050772554450. Exactly this sequence comes out of new Random(773).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 7 of Run 21 (seed 452,527,359): new Random(452527359), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 18:58–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related