201208080103 xtxei

explained decrypted filler

3DES(name+name) ECB, 15 GUIDs, seed 19

Metadata

Post ID: xtxei
Title: 201208080103 → 2012-08-08 01:03 on A858's clock
Posted (UTC): 2012-08-07 17:00:41
Timezone: UTC+8 · title 01:03 against posted 17:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(19).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 28 · predicted N = 15 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

7225A68499FAECDA 53C1462359C5D819 633B6A711D757498 97218B3D1D2D9184 642DD2B5E869D755 D414B7C567A64C2C CEDCCE499638640D 16409869A495EA51 9169059B42AF1403 3A9BCA43DEA9A87B 92660BEF06C3AFA6 6954E8E9DA43095D 285266E990985A2F 94F02C1A66AFA77F 67660A1734E93522 1B89F1C469D47B35 95454AA99707446A BDD5166EFEA0C180 2F4C8A08FB44A660 BD60281411797DC5 79FE6EDFDD5B2D85 83D70E1FE1D8CC06 24FF4BDFEA1BE7BF 67F4032CDD1824E1 806D1B9B7F400556 3AC8CDCCA86F681D 42C655657DBE57F0 8E161A9F94C87B69 27F8DDE813D47491 54E6D66A1BE0E75E 21B0DAE1DF73ED00 D766DB27F2AB4908 27DB0359921ECF22 0745CD78B7B67B3E 1A128ACE777F92A2 C572874DEE97F921 DD651E51418A693A E9B13E9FE14E2858 7A23FB2102F47693 38B7B4476D3AED66 BA74E6FF4B9C2D81 B79BFBCA7DCC95DA 11E262850CC5544B 1390C85E81D0AA01 D4E7165E8F572704 C862C1AC11B47512 BD18F4F0B4FE8F6D B427534BB006F029 19725FD4771CAECA 65301CCA8A31084D C9436D8E4EB3EBC5 3383D2B15E5CC2BE 578D4665003ABEA1 0DCB6CC2E7F48C11 77FE75E2D497669D FC4872E4D5CF88AD 4D950E9793E37F06 4EB37918F8C5CF2D BDCEA440ADABF8A1 C0302D654206DA7A 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ca7f02e4-f219-505b-b625-322fccc76614
  2 62735c34-44cf-3ac0-8e30-f70d7853e7eb
  3 931e4ff1-3bc3-026a-9a28-6b56d0968879
  4 cc3f549c-7225-5292-9014-f15de9a6470b
  5 67373810-fed6-76d4-a76c-e03e6d80adf2
  6 956f6952-87cb-1e36-b137-0891dffbc722
  7 425f6492-11a7-3d72-bdba-07e093ccf73c
  8 83f02af6-a3ac-81b3-b388-ed775d4c79e9
  9 b768a7c2-658c-2ab5-ab33-78309c9c56d0
 10 e95886e8-50f6-276e-9faf-f2f7631c167b
 11 a3ae94b3-dcba-2996-bd4d-e68048b137cd
 12 9afec02d-3fff-236f-bbd2-1a30190bac73
 13 160b616f-69fd-65c2-bb6a-6eafb2ec28ec
 14 7af131f2-4751-3675-8cdf-20d5ef4bd51a
 15 4d39ae27-0285-2410-b212-54a7c58c9856

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 530571382222632. Exactly this sequence comes out of new Random(19).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 28 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related