201208080027 xtv8i

explained decrypted filler

3DES(name+name) ECB, 18 GUIDs, seed 628

Metadata

Post ID: xtv8i
Title: 201208080027 → 2012-08-08 00:27 on A858's clock
Posted (UTC): 2012-08-07 16:24:33
Timezone: UTC+8 · title 00:27 against posted 16:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(628).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 22 · predicted N = 18 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 12 · 4
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

65DC390C246E71BF BB61779D09E6CCFF 07BB90325EF82959 7CB9B12FFE0FE614 12533833CAAEA51F 74C8400D0400BD01 C097F803E604E04A CCA6E0DCE367FCEC 51356F3310921511 4D8C24E0AF18E4A0 B494CC35139A46A2 18A0C354D9094389 F65A96817AEEDCA2 0CAE44BC02B2C18C 58FD15621DD213EB B4F43DCDCF4E0251 9384DEB1D22EDDC2 F0B25E182E622346 4BD39052C3A7DD3C 0E313C875724DBE5 18A917940550412B 0D995052AB16B404 DC270BBB62DE6189 4A1408A91CDFC4A3 862396A1A3C418D8 37D8B58D9DAFF9BF C4915298FBF16CE7 F51951DC6A45ED17 5F1B6A5D0217F7BD DB35072AFB623E62 64FEB9FA025CB827 173E0DA4A561BF76 34539EB77536B263 225A5871DDC7ED17 8BBC370D967D09B7 42AFE90B66E9F276 5928B5AFA1A26DFC DABABD9A0AFDE3FD F50D3ED46D089578 4DE6FA8FB7DEB79F A34E7B0EB5C6979A ECAE45E90F90444C 67A09A02E68DCDC4 75876F54A4FCB7DE 1D25CDAD3A4CFDF3 E02BBD039FABE573 D0DFF1C579E98FEF A2AA6BA536F236D9 C9AAB163120A2103 658243C7C8847FAB 35490CCB1354F678 BD0A1DE89E95AF39 A508C1B1A2B82D08 87C319673D07646E 3741AB1A7477C95E 9738A004DA054293 26FA11DA9402BEB3 54E1BBF2B76ADCC7 479A03B0DAC15DE8 391527B285EA5D7F 9EA3B6E19A88CB2C ED2202F05A6EA876 04F7E598EE41AEC6 657CD6BC78A8D3DD A06823465332F498 394504CE8ECDA57A D673493739032B8B F957DADDD9BCBAA1 F179E82A5AE69D39 797AC012F2A78F1F 29ADB22996CE3662 4B089E12DF143BEA 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f14d9783-0af7-78cf-9365-96836417d10c
  2 c57f0127-87c4-00aa-b275-df9459f67d18
  3 8b5cee34-79d7-6be9-bf58-cbf4f7b0a543
  4 10fdcfbe-e5aa-54fd-935d-7374978627fd
  5 71af2a5d-fd90-6ef5-8a44-585f793ea7dc
  6 3ec31575-9873-35c4-ba25-ab4529387682
  7 2dc7bf54-c569-2eea-8b48-82d96c108c6b
  8 7fba8fd6-0794-420d-bd9c-71a0283bdfde
  9 952905db-db72-6dbb-8ce0-657944c1141a
 10 f0949a42-9410-70ad-9324-3d3f9a70f050
 11 9192e049-d195-8b55-ba29-55035e3732d5
 12 56f07546-6eb0-6e21-b611-af13ba97c0c8
 13 a456013e-2234-34e9-aeea-246660bcfda4
 14 601b7948-8122-1c1d-b436-aeadb7a52dbd
 15 ac76634e-0aae-5da3-834b-b5a1f917dd6b
 16 6c5a58d9-5415-2ff5-8189-ff38aae8ffea
 17 aebde72d-a43f-708a-bb55-931adacd4936
 18 82a0f0ec-5811-3a37-84fc-f85fceb2a03c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 706563246786315273. Exactly this sequence comes out of new Random(628).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 22 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related