201208080109 xtxsj

explained decrypted filler

3DES(name+name) ECB, 19 GUIDs, seed 987

Metadata

Post ID: xtxsj
Title: 201208080109 → 2012-08-08 01:09 on A858's clock
Posted (UTC): 2012-08-07 17:06:42
Timezone: UTC+8 · title 01:09 against posted 17:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,232 hex characters · 616 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 19
Filler GUID seed: new Random(987).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 29 · predicted N = 19 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 2
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

8A8CEED231A57117 A305FF4E6E788154 9FDDF4D3A66F9690 93A340A023443854 4DE17B08D5CC0048 032D085473F25E42 0185E57AD1116A19 6BC9607F34862A1E 58013A40090BE645 AF31A80E1F4D445C 7BF8A5CF9D186B54 955A7BF93CC53D02 5632C8DC5356FD0C 8974411CEE8BB862 9269A103E164D044 271B44368A867D99 60404B22E72D574F 47F5F1E1DA3C8061 9D45652E6FB17913 C42A33E786118C7C 8BEAEB905497917C 8DF00F3AAB0A412C AFE401E6911A7A59 9D7F3387DBB90EA4 3D647A4DCF8F26FE A7A7ED2C795F9D04 501A6E26972B00AD 7B77ACE3337E78CA 87DC1B87B5650E8B A072E9E7C1FE235A 5704C29AA3FAD43A 4D8E30E3A82E7709 874FE7D701227F6D 57409392CD245AD7 F3A0924E792FFEDD 1D45E37D27C185AB EB025894010F767C EAEEC024CA85DE5B A279EA7E354FCAF5 E9567DC761A0038F 183F5E0283E4AC04 79349A4F4B4AE336 5769D4363E1ADEAF BC9E97227AF8F129 757237C9C4C11D6D 79665EC76A1ED014 80A621F4F20F9B4F 7BDADAC50E9900F1 50111376F4CDDBF0 158554997476D365 E79B4BDD0AE92889 9EAFEF6C002478C5 0713760144AA3A08 174F919334E3B3AB 3B48303D0F034D43 D4A0A5DFEC8E5A8D 486BBA8AC7BEA57E DAD95846EE70CB39 4038895CA055DBC8 9AAE15D237B83CCD F3F956410D10195C 3FCD5D96B7D33159 1F61644C5965AFA9 E9488EE3A7599025 84E3CCF1FAB57B5C B1949651DC927966 86ED1BDBC268B72B F7EC75EFF9EFC07A AFE0C84209DAE0AF 8C37AAB5A73E8D72 ECAA0305CE6C0C60 089E99CBC12CD616 A55D472BAA85FBD5 1CC25DE0F7421137 F5D41E63AED11E01 52A2F7760084FD7C 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).

Decrypted: GUID list

  1 66181b19-0c00-35d3-beae-5d0ec7fc8391
  2 85d0a5ec-7dbe-3021-b19b-891ce435a654
  3 7c08c324-6090-6334-8585-f25ad94d2353
  4 bad8cde0-2477-2422-beb0-fa44294f682a
  5 0dffbabc-b902-7f33-b6bd-647be2ba0f41
  6 39740d6d-f797-0ec3-9e08-c515fc73ed5d
  7 db753ae6-8f2d-17c0-a3f4-bd45a6338ae2
  8 70e5adc9-1fd7-5023-8fe6-a1c41289e42c
  9 709bf06d-4b1f-03f0-9f76-d6425140dc34
 10 ba5f3217-6e73-2640-8cc4-dfd3b3c28687
 11 1e8e42e6-2e7b-4bec-8ee8-71fedc57b4e5
 12 4f114d2f-60e9-091b-8e13-eead17779adc
 13 a43786f1-39d5-13a2-8fd2-2d1889270d95
 14 9631e8bf-95e5-8505-9f2c-25c244b0c35c
 15 b4b6556a-3b77-7e11-8b8e-1139bb099031
 16 b9d00c00-dcd2-3051-a6d8-262940964ea1
 17 77fc72e7-f9dc-6c5b-963f-7fe1995fb0b8
 18 e019075b-e9f4-85c2-9323-7ff2724c47dd
 19 01a44496-214f-31bc-9892-4a57d4f40c90

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3362701502401873683. Exactly this sequence comes out of new Random(987).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 29 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related