201210022200 10uoo2

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 436

Metadata

Post ID: 10uoo2
Title: 201210022200 → 2012-10-02 22:00 on A858's clock
Posted (UTC): 2012-10-03 02:00:52
Timezone: UTC−4 · title 22:00 against posted 02:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210022200) = 0f60186f901d16f5577788080a7b6c1a (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(436).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 54 · predicted N = 8 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6D8D285C80F164C2 8FAE569A3E77D9CE 36165C244509842A 239430F088BA4ED5 6C4D5A8760DB0E13 6DB7E74727F1AAA4 4EE786F6E210EBCB 5E24E2D0266C5457 B047C24C58A110DB 76B88B7E8694FFF0 A19E87BF4105FA3A EDDA49C9A8B1539D F843B73794144176 2B81C55C06B98AEB 6F28F06AE4C61D7D 2DAD1D58151006B3 2945CB2BA7D27F0C B150FD99AA8425C4 246AC0F35CA3F662 35CD758E1EBA7106 59F7A682FCEA1633 6B033E8104750F98 5E1CE983A1704E17 1A9AFBFC34F48085 2AE89079868212F9 64C9E5B5BD9EE265 F95E0451DE742974 D6EDB838F3181288 62C876F0CFE9F06E EEA0E2CF5A3ADD93 FE33B1268E9395B9 F5D2AD29C0ED3741 4AD6AB26429D1DA3

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210022200 (name+title). Key = MD5(password) = 0f60186f901d16f5577788080a7b6c1a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7b114d50-5b84-4e58-9b88-68cc8f3200a8
  2 b9246d77-3aa5-672b-a7b4-6ea6f4d2f28b
  3 a344e074-7606-4bff-b57c-372282584e2b
  4 2e170831-7243-5bd6-a945-6ceacdf2c341
  5 589a6d5a-5c20-01e1-8767-f8ceb6a76c4e
  6 cbf940aa-fea3-575b-9948-c77c04cdaf14
  7 edb11938-f59a-2179-8e25-df89fa0e7299
  8 59512772-b371-1d46-97fa-68b7f8348502

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 46450521. Exactly this sequence comes out of new Random(436).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 54 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related