201208031920 xn92k

explained decrypted filler

seed 482

Metadata

Post ID: xn92k
Title: 201208031920 → 2012-08-03 19:20 on A858's clock
Posted (UTC): 2012-08-03 23:17:50
Timezone: UTC−4 · title 19:20 against posted 23:17 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 12
Filler GUID seed: new Random(482).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 15 · predicted N = 12 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

5C9644DCFA3FFEE5 1296D18D797CE369 ACFE6F7E66F0D6EF 899D569940997DE9 B35288524EF1914E 029A20308C124F59 E71FBB2ED951C7C6 E47D8320C9DF2362 68EE4710F3AA6B8C 0F8B2297F789605C 5779CEB577769019 1667E23372609D23 896FD867A922C719 5DC2F362F42A8937 535286CAD7C505CD 77B0B16E84DEA415 528707AEB14E97D0 EECD5A4EB116673E C991525FD5E27A89 9402ACED90D68CD3 C8AE7F44F9C1E8EB 385A253DF24D9182 E3EC1F2E5E6C64B5 375E7691D82547AE 994BE4EE0EA26AD1 FBFC2F081A48C8AB 8FBE8DC354A8765B A42CB98B62AA7C92 9952C6FB9F2DCFDD FE298C413C15FDA6 56ABD0FD8CD88097 662E3B6C21BB8D5A 33CCB0D0A9FD18CB 26D26EEF7159FD2D DD198EDD894403A8 79D2F4676F8AD522 CC4112A489083B6F E2D85FDE3E2D5D04 F4E72BA955B05EC1 76FE04416C83B37D C70EC5A3FA687456 42B1EE0D21336ED7 6685970E7D80C2C9 9135413A6DEA1544 119A5F5FAE8C3282 2C33DF0529D39F6F E5ED4F5E31E05ED0 B4D8FED6106D47B2 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7a5454c0-307c-4d3e-b8e2-b7405dd47327
  2 b0821b4e-3bf8-26f9-916d-6b9d9dd91adb
  3 ccdde837-9fc6-6111-b523-399e75f31482
  4 666d5c3d-5911-3f45-a6b7-4f1614bc3029
  5 75194837-6297-748d-8166-ab10e6e43725
  6 ea35e876-16fb-6557-be13-45ee8b8a3a11
  7 1a268d6b-1227-7d55-9330-866867c26699
  8 d7e61610-f759-2edc-85f9-2e467e28f1b7
  9 f5739982-8c17-52c8-9ab3-a24338847a3a
 10 cee6e504-d866-07f0-923b-c669c0b0cfa1
 11 169520c6-fbf5-3cd8-8fdc-4fff60d5034c
 12 db39e890-12b2-6897-98de-cc186bfe556e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 426376725036. Exactly this sequence comes out of new Random(482).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 15 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related