201210041322 10y1c9

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 441

Metadata

Post ID: 10y1c9
Title: 201210041322 → 2012-10-04 13:22 on A858's clock
Posted (UTC): 2012-10-04 17:22:21
Timezone: UTC−4 · title 13:22 against posted 17:22 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210041322) = 8d7b951517b8331ff1b19eafde31c8dc (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(441).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 172 · predicted N = 8 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

04F5A037F6B9FD57 7D42F6B682975D2A B4A7926336296517 5200ACB39BA65624 EE53C892016899F9 EE897528EBEC8BC3 DDF4CDCF2ED1FB91 640C52529E38561C 2ED52102172875EF B3102C94BCE5F96B 29026740D23DCE1A AE89B34A4C876837 56BCB86E63FFDF69 98156EE76F00D6FA 5C480B8A54DDAF46 7B021319550673D5 86E829E332E30392 8797E1444A671A9D 656FB4F7DF73B990 5C1777EEF06D68CD BFE1A573A267F27B EEA8E6BDB376C77C 841F1509E4BC35EC 544E5086D50FEB2C F3B3F8B27645DB7B 3F5C70861C67BEE5 4EAA38CA5E139CE3 266145297DCA1A09 20C51EBF43B84554 8D6064C55CC90995 1FA386532BF9C90D D9901BC479ECB05B 0EA3E8A6CB02E312

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210041322 (name+title). Key = MD5(password) = 8d7b951517b8331ff1b19eafde31c8dc, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 30cc154a-b47b-1a56-ab8a-5af073459038
  2 b4535247-a80b-110d-b9bf-194c4a8fbcb9
  3 d9ec75c8-7763-0136-bb9b-1e015a05f931
  4 4b904e78-dcca-6eac-b5ce-d0077f5809db
  5 18c77ba2-1016-2732-9dd1-f38e2a33e59c
  6 b1ceacf5-266c-8bb8-9856-2e0a266604ba
  7 5312e8ef-89ac-4fa6-b620-fbdf6939e835
  8 43a4b6b7-fec5-6c40-8fd9-e756d6a31779

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 11062846. Exactly this sequence comes out of new Random(441).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 172 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related