201210040502 10xf2f

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 905

Metadata

Post ID: 10xf2f
Title: 201210040502 → 2012-10-04 05:02 on A858's clock
Posted (UTC): 2012-10-04 09:02:03
Timezone: UTC−4 · title 05:02 against posted 09:02 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210040502) = e7d31ee99c774b9a18f4320d03582c58 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(905).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 147 · predicted N = 8 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4845AC1A37743132 DAE61246B7A0E1E3 21CD5A3ACA675B25 0478B3CBCB904412 A53E6849A2D26E6C 58CD245CD2DC50B1 07884D073EC27F7B 8E95029C11A97DDD D6FC4C7B5477A384 434E6AA4A979343E 183BC8D52A195F5D 8E70B926C501988E 09431C39032CB56F 8D7474B5729DA661 B610F9AA169F75FD 094787E92955D99E C2BD4AB3DB069FC2 13B39410002D404D E74362EB20B6969E 88921A26CADC3FEB 8CCF814F4D688DE1 208C3ECD3049F4EE 8B3E72B6848B9B82 074760801177951B 39BC1C8C0493FBBA 5EE4B57854323090 48A8F1D5822B8919 EF4849229E9F532B 24409DF71ED79BE6 73024EF026561B96 868475E5A2CC9E76 ED0EC016CD7024F9 20F651111FF378DF

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210040502 (name+title). Key = MD5(password) = e7d31ee99c774b9a18f4320d03582c58, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a222d0d0-f769-41ca-9b92-594617714536
  2 b0b1ab1f-723d-3486-a5d3-82f965022416
  3 afab672a-0521-330d-8942-3600e2d0cebb
  4 e505b1df-50a0-6681-8c08-39947fb9aec6
  5 475091d8-10d5-7b83-aeb7-6f3bdec0b468
  6 686c707a-1b7d-326a-82f4-a9eedeba744c
  7 0c91a179-7137-394a-8e3b-b55462f5752c
  8 7a8252cf-9fa2-4031-86a6-7c4364f82f6d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 43367334. Exactly this sequence comes out of new Random(905).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 147 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related