201210040942 10xnuu

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 549

Metadata

Post ID: 10xnuu
Title: 201210040942 → 2012-10-04 09:42 on A858's clock
Posted (UTC): 2012-10-04 13:42:14
Timezone: UTC−4 · title 09:42 against posted 13:42 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210040942) = ad80d0181dfec80b485af697f0ca2906 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(549).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 161 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

212469977DF1134E C7F3529A170AE647 28F21E004584A148 C9E08F07B10F185C 1B8A678182D11253 F9DFD0ADACB10BA4 129EEF7A2F8EC9A5 DCD8C163FDC5DD5E FFFBBF4555FA93A9 8F2756F509333B74 F47CA2CA8414FC76 05EFAE515584C61F 5E191D396070428C F76281B91B9E2279 F7A795C2451A3CE8 C61F628E1BBD35AA C7BACD68D82A425B A13A4898B5BF27FB 4CAB317ACFAD2BD2 4527A4318E4FA0F4 BD16F40BEFDA69D9 F6A8AFA51C29FD9B 1A6C01701615EADA 0B8B1CE4214394AA C1B99CCA27641152 A411FCBE3771D103 6395C44694ADDEA8 E70FD6F0FC5F6EF4 EE6120FA786FC841 159189CB04A25A94 F8339B8091E0DB80 E1036F275446AEAC 23EDF9995F36F7A9 65DB467D98277E6F A21B8A2AB69D478E 2C6CB101E63E55AD 703BC1430C921789 B23375B520DD1D0C DEC9FF9071753BA1 A96609793BFE33F2 D977C8443EE50145 B5E529727B82A64C 425E00170477EA05 5E181701565CE575 6344002B12A2C834

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210040942 (name+title). Key = MD5(password) = ad80d0181dfec80b485af697f0ca2906, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a7d9cc35-aa67-4f5b-8e92-7b7ded726d25
  2 95bc89bc-456a-85f6-bcf6-219c5588d501
  3 10bdbd98-f472-4d1a-916a-50f29961b588
  4 f8b9443a-ac4f-6fe8-91dc-9e6a422b10a4
  5 dc61bcc2-9c88-0ec4-a695-aa598f196850
  6 54e33106-ce5d-2d37-a61f-de061f57fe79
  7 45f342de-6f0c-8da5-9236-c23f1cb78f3a
  8 43bdcc72-9a05-7b26-a334-b9cafc35151d
  9 5180c890-c60b-8b55-a704-c8bf09276f28
 10 bce5dcf4-c3a7-6dc1-bf1b-be8b38c288f6
 11 6999071d-fa67-65fe-932f-4d2076bf7580

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 48460287866. Exactly this sequence comes out of new Random(549).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 161 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related