201210040702 10xi0b

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 549

Metadata

Post ID: 10xi0b
Title: 201210040702 → 2012-10-04 07:02 on A858's clock
Posted (UTC): 2012-10-04 11:02:08
Timezone: UTC−4 · title 07:02 against posted 11:02 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210040702) = 84b6324b1e698ee05036a0e771620291 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(549).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 153 · predicted N = 10 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9B5BD8454633BDBD D0353DA82368220B FB204F305A63744E 2C292F153F1EA0B8 1BDBC49EB7D5A7D3 E3237C46BB732C6B F188F98686453147 7B572EFC17C0569C 4D4DF43A0E082928 CCF82A41D2E0446B 20C7C47FAD05AEBA 10D6C85FF6C4A393 D81822F233FCA65F FCCC1FC0DD6C2366 54CF1765A7BF9181 68CB83E705887399 2349868725F2E3A6 55EFAD5B4A8534B0 649612264A8A3369 27D14738A32FFE17 2BB601BFF02CD3D9 03C598EBC0B5663B 896F035CA1E63C68 88FE7FEE9F4ED6A0 EB1B9E9668235484 47DCAD743B1F36DA 90446B69F75EC6B0 E2DFB18897149A69 45E7F865A0D62618 ED12FB4F847507D3 D691359609F9C863 532AF2307273669E 7BE7269CF00C664E 236DEA64C3D1FC94 C880E9143DAC9082 B4452642D89106F1 68EDC0D0935D60B8 E208878858D25202 DDEC6881AB184652 55AFCF2D5F1692F0 B9E8779A687BA6B8

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210040702 (name+title). Key = MD5(password) = 84b6324b1e698ee05036a0e771620291, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4d3dbb57-6ac4-47a1-aa6f-22e6bebb1241
  2 40fd8a74-45fb-822a-ad8a-f5c62f2f1b66
  3 d8a666c2-7f2c-4ec7-91a1-31be12f9d671
  4 f3095560-e4b1-6eec-b196-0931e6f29a01
  5 1f64e76f-87b7-086f-9ede-a33d64a10cf2
  6 f9e1e8eb-f323-2d58-80c8-8affcf8bf8de
  7 7f67572e-89c9-8723-8875-00d5d490afee
  8 85ca9d8f-6847-72cf-8037-87101dc82a67
  9 fa6b6637-d10f-8378-91f2-db7a9794964c
 10 4b0508e2-0e88-6c46-b01a-d5213d8afdd0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4846028786. Exactly this sequence comes out of new Random(549).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 153 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related