201208030907 xlcs0

explained decrypted filler

seed 647

Metadata

Post ID: xlcs0
Title: 201208030907 → 2012-08-03 09:07 on A858's clock
Posted (UTC): 2012-08-03 00:04:35
Timezone: UTC+9 · title 09:07 against posted 00:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 12
Filler GUID seed: new Random(647).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 1 · predicted N = 12 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

82973712E41CDF19 9A117A376FB594B4 1D6BFCB9CED88469 D9DC783283C36E9C 247D7476D5F23F09 0CBC6B5A407680DE 4C15C017A0FA25A2 09C36516F93BA86D 667B89CB907236BA 3D518659B66DFA3C 344F272CC6F25287 44E0545993A54BB4 BF980ABD9009C1C8 CAC4D8F3605D0C07 8F3E29B4B4915D49 B3F1B9B6815E9831 4B386E2D7573E55F C0D452DEC7100306 BA5DD1164960EE5D 5B0E0A4AE0607EF2 3C532A901B1C32AE 24B63F28ED6319DC AB7981C0054882DC C12E93700C0378DD 9BC1C705151BBE5E D403DFD7D27452F1 3E014E66B26B7A91 1EC5BC7CBCA0C8FB BB29A21E8411B639 9C3938F69B1BF038 1C6DDBF7A0626D6D C8D53B5EFBFC929F D428EF71FA767162 9DC198DDD33833ED 993DC77B9210B61E F82FBA2F3B8D8E96 0D154F6E152EE0E9 7DC8168D1632FA16 04271AA165708B74 00388FA101614BCB A79DE5BD53E48658 55F47733D37A5AE2 84F382399A467D04 04AA258DDAB77896 3B3D4767CB4B4A25 3313654C73BB017A CB67B71C00D32EDD 929F69445FEDB37A 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9ec458b0-48cb-6aaf-abe8-691afd5e4b12
  2 d6d157f4-f117-50c1-98c2-b1d2f39e5db6
  3 85613b01-a989-07ec-b8f2-1b1ce40e426b
  4 36343530-92d4-5c71-9217-b22c78256fe9
  5 a597bfd4-8887-2368-81d3-0ab8a9f139e4
  6 53b0d0b6-e68f-8acc-b8fd-ffafc2e640f9
  7 709cd523-cb84-7843-ba99-b614a7bfc430
  8 5a35d44a-f56b-083b-96da-492a8cf39ca1
  9 40fa52ef-b9bf-05d0-8061-72f4d1e7ba91
 10 55e5f446-48c7-711b-b33f-73de83826460
 11 2fea708a-e8c5-8c0c-8632-48d3259af58b
 12 e1f69ad2-7f58-53bc-aeba-1a94daedd695

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 650528700785. Exactly this sequence comes out of new Random(647).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related