201208031727 xm1jn

explained decrypted filler

seed 522

Metadata

Post ID: xm1jn
Title: 201208031727 → 2012-08-03 17:27 on A858's clock
Posted (UTC): 2012-08-03 08:24:38
Timezone: UTC+9 · title 17:27 against posted 08:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 14
Filler GUID seed: new Random(522).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 5 · predicted N = 14 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

DA8B52AE3625277C 68FF89CDF66C87BE 115C9AC8502CD5FD 310EC5EC2A438370 905443BBEBC51CED 7EEBD6AC075444A4 537F525D8E4EBEC1 5ECF824394B32E35 C960F4936EE988BF 63CC0E0F8602A523 D9A101550950C2F8 83C0265B38F0ACDF 21AE64EC27C81BC9 BC0AF1232B52D4E5 2FC40E5571FAF328 E2EBB8042D815459 436E13DA17174060 199D46564EF15A29 FCFC718F46FA2BE2 93746936C779746A D38EF72BC337B1D9 B468EB06E30211AE B5125FE918AFD23D B33CC498724F3D8C D592BB390F61EC09 521C9F5A19667B38 5EF72879988EF1DE 85A97BE1BEFB8425 DE4E26CD7E9B00C4 E2409CA5F5C1F2B5 5B32D6A5E77506F2 CD2C032012FF3042 397FD4400E1D4A95 124DB44F0E8400AF BC4F5F8CC68B8869 945D95FD70041CFD 6D1AAA1ECA3E4DBB 3D440CED8CAF6C96 B867789FCFB14B90 DB55FCB44B563AD3 FD2FC6E11832430C 2DFE37166BD7098E 5CC997358C12CA37 5967382F5C1E6255 E188E39388B54C3C 7A6E6DDE59A374AA EBB79035410538F0 637AC30DE3B2D118 3EEF6BB6EE6DDBF9 94C81B6AB79F9B5C 264A9E43AA48448C EDCF3133B8D9C979 A3442C159A6655FC 4614A0981AC6F722 188CEA1A93761748 C54724266C97D566 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 61e8b536-16ba-34bf-9ce8-4353474325d4
  2 d3d288ad-c8f9-84dd-835a-31e151f9cf33
  3 facaac09-e40e-5f20-8114-f53e1421cbab
  4 b8450711-55ec-852c-a08c-a912ac256353
  5 46789c61-27f2-7f3f-a5a2-e29f9637854a
  6 a2fb81ed-5348-628d-8410-f913759a51ec
  7 8568887e-a708-7585-8782-b3994dbb6fa6
  8 7c1c81d6-d949-2f59-b041-c55d61bb9c78
  9 f172d278-8f0f-55df-8473-8cf3c4e22fc1
 10 790edd7f-d6cc-68c2-96df-1b480bed7043
 11 a36138c3-bd40-71b8-8968-c9c7d5665ffe
 12 eaf1e698-9033-0476-aba8-f2bb90b94162
 13 9007a908-66a1-4a2e-9f2f-8fcd140d8464
 14 50eece8f-9a1e-00b0-ae4c-6f93c291931c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 38587672567040. Exactly this sequence comes out of new Random(522).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related