201210040522 10xfj2

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 720

Metadata

Post ID: 10xfj2
Title: 201210040522 → 2012-10-04 05:22 on A858's clock
Posted (UTC): 2012-10-04 09:22:04
Timezone: UTC−4 · title 05:22 against posted 09:22 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210040522) = e5707796f715c8fa3ec5904b4c961063 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(720).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 148 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F93371A537C20FF2 96AF6E14976AB0A6 A274DE1F9B4AB084 2F4DE456BD5B18AA 0A98FD7B11FE3F12 E24372684050518A C2B2404B81B61205 D52EBCAAC59209CB 295FD23732E0451E F9AD4452950DAD5D B8B361E8F2412FF7 7F5799E129DAA2E7 005493DD18407306 8D4305DF982141A2 2B89B9794DB54041 0C8A046423CE1841 094C8E6E8BFF2F97 852BEFF7E23AECFA 596E86687F5BFDCF 35692FDD4A1F35FD 74773A31199F49DC EA2F92E8D2DE0F82 76550030D3AFE08D 4C7F6437E0FF7FC7 B9FF1C9110ECE366 5DDB29FE1E9CC2BC 910FAB03CB987A55 FFB8DB928C94B243 BD1C970FCA7C66FA 40015E4571F99D6E F6838D611C40620C A95275D29486EEA1 9F67AACCAB2E3DF1 37438E0EC69CD7AD 9B562F900D713E37 82B0A48EFE8234AE 990171C302EE89E2 73F052990150ED93 2E4117476EC50BF2 6F2780CC6F580259 1BFF3B247FA94731 4F9A02C57C7BF37C 20C8FA1F26505969 E74D151E2EFB4DBA 26E6C06EB63DF3EA ED5F3B3EEFE87B2E 2BFFD9A9914C1AAA BD386AF0D4BCCE57 25215772A77A32AE

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210040522 (name+title). Key = MD5(password) = e5707796f715c8fa3ec5904b4c961063, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fd827745-7027-7c85-b0f5-fe0a109cb4c3
  2 89623836-8110-0fd0-a328-3eb107b7b7e0
  3 2b3983b6-b5e3-05c1-a7e8-0db467dde45c
  4 36c905dc-3acc-2162-be06-7c4d5f9fc8f7
  5 688c2ca1-129a-2376-960b-5759b93f5600
  6 ed6f042f-a0f8-64f8-9831-190c6d6c22c2
  7 3654f1e4-8776-407b-b3fb-104951df4310
  8 cca68c42-efaf-551a-8249-2296398b68e8
  9 d978c675-178e-0aa1-ba36-eb8ab76e311f
 10 10c79353-31f1-69fe-b123-9f1cde610147
 11 d770aaf7-f2a8-6f39-81b4-d2b3c26985f0
 12 aee5dd96-ed38-5676-87c0-62a64deac9cf

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 700226450665. Exactly this sequence comes out of new Random(720).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 148 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related