201210032041 10woj4

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 44

Metadata

Post ID: 10woj4
Title: 201210032041 → 2012-10-03 20:41 on A858's clock
Posted (UTC): 2012-10-04 00:41:40
Timezone: UTC−4 · title 20:41 against posted 00:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210032041) = 31a3ebd0b25e76c28eb07824d4948685 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(44).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 122 · predicted N = 10 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A822F76172E26A1E 0FFD8D2BE2913215 A66BC605B087CFF1 082BACBDCB45F03B DCCBD64866F02769 B5EDD85B65E07364 2C7FED8644CA7410 132C116FC9D67B71 9275817D104C35D4 97B4899F17B960F3 546B1A6B0C3BEC4D 7C0B35357A2FABA8 F41468FA0BDF549B 2D3EC34E2C0C4673 7E6CD8132DC58C67 1BA2EE3BB82FF986 FA8F5756AF01E9EB ACD808CA5838A3FF F5FEE10A8BF1392D 27F10F4B34DA79B7 7CBFA8EF8270268D 0EEE5E0C8894E721 79E80370D7730BFF AF6280D104B24F82 8CEAFB762868CD42 B5FE950AD56528B2 C304BCDC11072075 33B0434F7A60E853 546B660A4CC49F1D D183ADE10A045838 6564032C7427EE07 DF0A74C4C6DB9EC7 7CE14FBFDC77EA98 8A39A7296562D1A4 ECDEE8596B979EA4 60F1D47B8FC4E758 2A6D3286C7E9545F 83B58FD4D780ADA4 1D17B2C57DE14AB4 CDF7494C3DEDAC47 B6DB38AEC4A27644

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210032041 (name+title). Key = MD5(password) = 31a3ebd0b25e76c28eb07824d4948685, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 51edfda9-da14-6fe7-b226-9930ac9b90c5
  2 61594607-4cbc-6bf1-a246-4769c7bf9fe8
  3 f1193be3-4df7-4daf-9a83-ff1b37023301
  4 5f218d7f-232a-87db-86af-5664e7bde391
  5 8993fb41-65aa-0378-989c-3684573fbfda
  6 7bb64b5f-0efa-054b-a022-2bf1d336e67c
  7 6ec19b89-adc1-5ada-a136-6293db8bbfc3
  8 1a132a7f-0901-4cb3-ae83-796e27a82b69
  9 b3abf8df-d4cd-3d8a-a83f-293fe1e462de
 10 e0ab79c3-9c3e-483d-b47f-943c96d8f349

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6648005434. Exactly this sequence comes out of new Random(44).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 122 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related