201210020920 10tc00

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 777

Metadata

Post ID: 10tc00
Title: 201210020920 → 2012-10-02 09:20 on A858's clock
Posted (UTC): 2012-10-02 13:20:13
Timezone: UTC−4 · title 09:20 against posted 13:20 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210020920) = 18d21d1b9d6b3d5c232425c961bbe641 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(777).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 16 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C825A0EC57A3F270 7BF738E627949343 BAF533CC1895D4C1 DD52678738738A6F D171B90E3A0895E0 C79B49435A6D8323 CFE6C069A4F84CAE 0632F63E6DC2C12E ACB0FD9A6530AF28 B94CFE6EF9A57831 97421F9E0EEA81A3 C3BAEC8A0C9A17D8 F1BF34B47851EF3E 818199F5AAB990B6 8FBE7481C006D82D 6F1407A78DB4B0D6 9DA16FD00B840585 9825634002E210DC 39EDA75FDDED7387 0E594FB9CCA3C6F3 D840C29FA5711A5E 05364694121209B9 78D26D6365BD6D5A 700DD41D6AF89657 4BAE2BE2AB5F82E7 8B86DF5FEFDC3429 504D772D821128A3 CCE6F1AD8A2FFD41 0814D3977D143897 B52120A067BBF6E8 C619ADD7D344A8DB 48A00746F435AAEE 3905C5F473796993 29B44E64165C1295 7A87C868E9BD56B5 A4869AE12B27D9BC 530F84A3C759FD42 190777F184B43816 53457B738519FE3C 7C9194A0E253CDB4 FBE31C500AE98C90 A148583585022D41 40256DA23FE91B55 03E2515D31F053AF ECFF9B811F559B1A 37C19B85214E6425 FB537661C3E1F2F5 6D2C2027DFA5ECC7 16E4998880E7BD47

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210020920 (name+title). Key = MD5(password) = 18d21d1b9d6b3d5c232425c961bbe641, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e3ccb102-85a1-5a2f-9f10-f90d5d78e891
  2 6ac15691-3985-759f-8f29-cf5640a54768
  3 9717e7f9-b18a-7f22-98e8-89cded700114
  4 cc22b06c-20ce-3adb-a0ab-9486fa7cf3db
  5 7edcb33c-a4a6-050f-842b-945b141e20a1
  6 5b2a026b-43d4-5037-a4be-551e95a69fc0
  7 1196d977-6a9d-018d-ac28-2a9ca41e5c50
  8 fa0fbf96-0434-23a4-ac30-318d0e5b1bf9
  9 8d2d1735-a76b-0fc1-97cf-c6bcf3ec2fbd
 10 b8354cce-e788-7c9b-a52b-95beda6dbd8d
 11 607ca178-1d9d-6ca1-b36e-f953bb69eaf1
 12 6f127571-7ca2-0c54-b80a-8883ed5afb0e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 577305020760. Exactly this sequence comes out of new Random(777).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 16 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related