201210021140 10tjsp

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 110

Metadata

Post ID: 10tjsp
Title: 201210021140 → 2012-10-02 11:40 on A858's clock
Posted (UTC): 2012-10-02 15:40:18
Timezone: UTC−4 · title 11:40 against posted 15:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210021140) = dd96d62c3eb9ca3496cdcd329b1b4ea8 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(110).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 23 · predicted N = 10 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1C5E0C601ED3C58A F7A750E9EA98F4A8 E36C260497238BC3 CB132235B74DA891 CDEA4A676C765C1F 7C33FE7F3149C7D0 A2B859ABECEE94D5 ABC9FF21A852060D F507B2C5A832AD0C 06EF7A2F775E27E6 E535F0607CCA282B 47E8E58F0CD71E50 03757C9E0AA588DD E9B4A3772252FCD8 04578693850BF263 0F4D82B60EEDCA65 7C46392D6DE3FBE0 3254170F413556B7 D7E5FD34077C1E0D B1002D37AC3167B4 640392DAB7F96A54 0F516DBAE4AF2638 EDECD120C4D79728 78184ADE65BFAFF2 BE6241B21D957C3F C902B7F62DD5A151 A357F81C689332EA 677B6C46EDB59AB0 8652CAAA89D92C9D 9C65F3993396ECBF 0B2568C5E37E7D92 9B23F56CA4C8648C 64BD8AFB3C15500D 1DAB3F20F7FA06EB 6E537089A14C703E 014A59B8EFB21E50 F51E673D50AE17C9 A8F22930435930BB 7256836C9485C341 4CAD48053040230F 4D4FD2AF571C1210

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210021140 (name+title). Key = MD5(password) = dd96d62c3eb9ca3496cdcd329b1b4ea8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 51a58510-c21f-10a6-ba69-cb83530faaad
  2 ea85e2f0-18ea-0ce4-b07e-da66fbf23dac
  3 e100e431-4773-5a06-a782-6a9a6e43652e
  4 7fc523a0-4489-00d1-bf93-b20c17491e5d
  5 3f00275b-a657-7ff4-8c8c-d7b4c471da24
  6 394d5409-f5cb-6e23-b728-00d34e15676f
  7 c2f84891-6c98-12b2-bf24-bbf0441892e4
  8 6b8d8c87-7b93-5dcb-8a95-620f3786f988
  9 1fa35689-3d31-5df5-9cd9-23f4b8a0e1d4
 10 77d05e00-a919-74d2-a69c-c2bffa7024f1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1050761557. Exactly this sequence comes out of new Random(110).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 23 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related