201208031820 xn5in

explained decrypted filler

seed 592

Metadata

Post ID: xn5in
Title: 201208031820 → 2012-08-03 18:20 on A858's clock
Posted (UTC): 2012-08-03 22:17:45
Timezone: UTC−4 · title 18:20 against posted 22:17 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 13
Filler GUID seed: new Random(592).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 12 · predicted N = 13 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

06A5C6533507E797 C9607E07398EDA26 5D10794EBB192E0D AA188B569A7AA16A 48B64ED9123535D4 02F45EAABC542034 2EE4B5C1FC96CEF2 9D43ACB43EA6146C 1307537980678362 426DCC6768F84278 14955CA60D119701 BF05F052EE5578B7 927BB70A8E5D2209 88B6E425C4D38E5E 2386C12182F88E5C B5555A5487BF8726 3919D91B975B9D46 1673C605245D7FE5 0D5F45584459CA6B 7DFAD9F76BD97BA7 E825F3C938E5319E 1941E525876DD734 72A73B9E6DB9754B BB65D785AB37A916 B2D802DBECDBCE18 47D575E2BEE87D26 50F954D3F024DEE5 2F2D075D870B3604 02C8F652FA3BBF3C 7B94258277BCD4FB 09084F7F531ACD39 EC19BAC742F68454 2701BCABB70C0304 543826CC79395539 E2CB76BF8257BA6A B1CFA8DEA245EC38 C43C126C06853F70 559147662D65F09F D18D6B05AC87D2FB 7D4E4D13656AF4BA F851DC7704A0F461 9EE34AAC1BA1DDC2 2C6AA78435BE61A8 8DAADCE8E91D5C67 CDC34324F0BEFC0C CFFC26A9DBA40FC6 EF4EDBC18A9F5B56 B122AAE99EB12FD8 F7834837E140E330 B230B5BE0F6392F8 2D4C6864DC3F2647 EE07D8146B2A3E50 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a0e52b97-9476-0abb-bf3b-e14d183b9d2d
  2 f52078c2-1b30-4471-a04f-333d37384b46
  3 e47f9e5f-f15c-5d39-8cc2-bfa06f4ef5cd
  4 ee68548e-20b8-87c7-bc61-b8103023550f
  5 6008b56d-1f66-4658-8bf3-b23785f1c5bf
  6 3e6a9a90-1104-8027-9528-7db4cf40f0ce
  7 ce4679dd-8ed8-184d-abb1-b063ad041cf6
  8 56391c2b-1b04-34aa-a952-dd862aa82991
  9 88df4c9e-0184-1c09-90d2-1416892b68bc
 10 342f18a1-3b2a-59f6-9c52-9fcf7aac9831
 11 5b75980e-cb1d-30f0-a263-56bb8552888e
 12 34bffe35-4e53-53ad-9815-a49104bd1c00
 13 50706f1f-0389-5021-a7b2-27fc6ffc550f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0458481315355. Exactly this sequence comes out of new Random(592).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 12 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related