201208031900 xn7wt

explained decrypted filler

seed 185

Metadata

Post ID: xn7wt
Title: 201208031900 → 2012-08-03 19:00 on A858's clock
Posted (UTC): 2012-08-03 22:57:49
Timezone: UTC−4 · title 19:00 against posted 22:57 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 10
Filler GUID seed: new Random(185).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 14 · predicted N = 10 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

00271AF1A47D3A80 13653DEDAAC855CD 338E5CB43CAFD08E 48E33EAF2308BB4E 2E924BA1DC3D7E42 78A33E0226E8C5CC 903277914A0EF142 EB619564BBADDB3B 151D1D0EBDF04625 6E09B189598275D4 7F259DC94FA5CEDC 624AF47250516E24 F049106BB3909FC7 934B3D176B370AA7 4C6742EA86C543AE 15779F38A9DBFC1B 22E1D441D4843A94 701BE519F12BB63C C4D5977C8600DEFA FE1BABA145D4833A 34E13ADE9C8870D6 29DBEE96B5C39E4A DD925B612B8C9C33 38011C7B8A98561C 5893EF57BDF88071 6FEBE58D01644C82 FDF05DB22A0109B5 EEE6EB9ADDAED1DA 2BF40C6E54979D87 519E0F0924A6BFAE B1089ADFE1EAF33A 752E7A4D7490DE43 6C90B7E6263B8463 22DD104C80FAE1A4 DFB731D63DC15A9A 95C67E513E2AA864 6F584202FE6B0735 B30F0EE4872358BA 9040CC75AE2BC83E FDCE4C54B605A1E4 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 da54f559-4da1-394a-8b4c-fa7d787d21ad
  2 a88b380f-ba09-08c2-823d-eb5a59d9fe8a
  3 9aa19f46-0d26-0fa8-8d72-eb2f8c79a8ed
  4 74dd502f-0322-0464-94e9-e30597131cff
  5 ff6d7963-7efe-6f1c-924a-b39b5fdf9d23
  6 d45834df-4e6d-2775-9702-0133a1701eae
  7 041ff4ab-1fce-7bfa-a7f7-11e29cf60ef5
  8 5561cd3a-752b-229d-9bc8-a4abca3d8e8f
  9 61b9838f-017c-77ae-a569-5de2f7f1bba4
 10 739d22d4-14ed-4492-908e-bff06dfb8ee8

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3000627274. Exactly this sequence comes out of new Random(185).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 14 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related