201208030702 xl4zd

explained decrypted filler

seed 959

Metadata

Post ID: xl4zd
Title: 201208030702 → 2012-08-03 07:02 on A858's clock
Posted (UTC): 2012-08-02 21:59:33
Timezone: UTC+9 · title 07:02 against posted 21:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 20
Filler GUID seed: new Random(959).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 0 · predicted N = 20 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

DFA81EF94EAFEAC6 8957FE380299E224 1E5E50EEA7A3324B 6442F4D752DAF29C 8C5C44B3B5C32CF1 F70A9A00CCD0BF64 C54D299BD0177629 9F8924EC1EE8BEEA DD930DB616259ED3 5DAB3FA929F5BBF0 CDE54ECF2D299411 D19914B89A9406BE A2BECCDED5ACCFA5 E03ABEE5EE17F157 F783E38855984FC1 FCD70C3431FD80DE C3425BAE20EF1010 33FD2E14C1EF5C0C CCEC9268BBFA421A 61BD2B4B4084F5AF 03A63F4E83BDEECF 97574EEEEAD06B0F 5FFC1652D458D8BF 5E00FA2213861B23 949CB1B00782793E 56BE7561E37BE292 B01CF88C37550AE5 85D1AE79A9B92088 F34ADB19447612EA 23D52FC04D419ABE 7AFBEAA0F764EE97 B784E974FF420AF8 EAEA2F689EAB5542 28ADCD293672B15B 2D45652A38A86C68 54D1DDCF12DC4CB3 3E59A09DDF39CD07 30493C436A9D3512 9DFE68F71562F9EF BE9A923B020D98D1 9345003D6208F6D5 5EC98FEB3D28C600 0AE1E007E7C97291 3C90DF28D398DD62 B2E7995CA58D3CB2 B075D78C902468FE 4C643E038DD368BE FD2F421ED992D9F4 4F9949AED6B4DF3C 90FA74B7C7ACA8FA 3FA1B278B6575514 C8D6AC1ACB309726 E4E00BFFF43CA251 868F2A5AFC41A90B 1FD6F40E676F9D5B 9DD7A4E9B3C3D915 0505BF7BEF4C5F11 9F834F17BCB3B3B0 7DFB672F300ADD89 D3A709A0086DC2A8 0A6855B1CB68BD11 71A8D759D4AE5628 199E1CD94776B90A 0B8071CCB27E0D60 B97430DB5F336791 E852F96AC9B6CF79 2529E32EE1B5D981 3ABF8A8FC47F0209 B1D024C6501A33C1 303BE60358682D90 325803AF3954D038 48BA9E3EF4693B08 6DF6E47D81F08AA1 965AD92595A08B45 B93F7DFFB549DA6E 0370D1EEB8B6A80F 1354C459D9B156DB DAD0D11FA17C55C9 449CF4ACA8F6BB19 B0C22EFD427FFB7B 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 663c224d-ef73-6b72-b6c4-767d69ba0615
  2 3073b9b6-9dab-1da6-b7db-ca0d059104c4
  3 28f751a5-e494-01f5-bef4-2a2e482becc9
  4 c20b8c9d-2815-23a0-b75c-fca1620c70c7
  5 fc66829c-c352-1d11-a919-1016184105e8
  6 9726add8-7c2c-5489-9e4e-132bccaf92a7
  7 9668ad25-2852-5ba5-9cae-9e5ae9958bad
  8 3fd671de-8c4a-5fa3-bd66-e2fff28e11ac
  9 4d61a3a0-f7b2-5a69-b1a8-1a99d68f338b
 10 414be90a-5b9d-89d5-9d11-c20441c46a55
 11 1c6eb3bd-5be6-7d68-adbb-4bc5892af712
 12 32b16f2f-e3e6-15db-84f1-997fa5dcf95b
 13 a9db6c1d-e4a3-8805-8cc5-14dc64fc90a6
 14 29eb1201-21de-3696-82df-ed7fb1a3f5b3
 15 d261d0ce-2b60-25ba-9e40-e875ea2cfef0
 16 2925de3c-8b1d-81d3-bf62-11c2b6f70d23
 17 40f4e0d3-d572-81d6-9dbe-6e33c20d8964
 18 3d064355-1823-527c-a86d-deda5d08117b
 19 01d2f892-daf4-5602-95ba-77567e9f6f39
 20 a280bfb2-b76e-58d1-8ea9-d3bbc6b2cae9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 61021555587183288555. Exactly this sequence comes out of new Random(959).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related