201210050322 10zelp

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 998

Metadata

Post ID: 10zelp
Title: 201210050322 → 2012-10-05 03:22 on A858's clock
Posted (UTC): 2012-10-05 07:22:59
Timezone: UTC−4 · title 03:22 against posted 07:22 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050322) = f9038ae9d4a4f3f6a383a024dbbc47f7 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(998).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 214 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

670BC5622601D71E 479902225768535E 5D7F495B72569465 730E43631C5E4238 D50E79204CC85673 2054045AECCDDB8C 0145A2B7F919F28B 3173BDB7A4850FA8 92EA4AB870B3CC53 9FAA312244C04FF1 E990072CF0D075BC 23D0E62D9026DE2D 682B5CD7DE37B410 FEA764458396BB0B 9ED648DADD9EC1AB B5AEC61B150F7F53 3F19F6F923508589 C9988AAF27E4CEDC 8156F873331A5D45 8AEA51A70860DA6C C59ABCB189D09F7C 7FD88E92EE7D0C31 5B8D5369A3320479 0C4BF50B34B4175D 2F21F94E606CC9C0 EAE496390F095C60 82AB7EB8C4C7D862 719132F38102CB9B 9E655A46FD993D6C CD7015E4CA032DD7 F8B75B149684BF20 948C8B82B3C19BA4 46E96F6545DB5CAB E0BB83AB3D93E7FE 9AA39CB08A0DCA5F CDD438A01A230A03 05E778D616D48F16

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050322 (name+title). Key = MD5(password) = f9038ae9d4a4f3f6a383a024dbbc47f7, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 317206ce-1797-0d64-875d-7a5b01992f8b
  2 a31b732b-b7d3-54c9-afc5-a08be37b21c1
  3 93fdb3ec-438e-33f1-a59c-9aca7a56d3bf
  4 ba3554ec-67fd-560a-85f2-09e94f16c706
  5 43ae1306-8f68-759f-bed4-2b48611dad01
  6 a90c5880-220b-6c76-9422-dfd2dbd7211f
  7 70ab7b41-ebdc-0472-ac74-f08de79b16ff
  8 efed2afa-14aa-1a2b-8a21-85a47b0d9561
  9 a573b9a9-12a5-4448-97f8-551ef8221a40

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 053576014. Exactly this sequence comes out of new Random(998).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 214 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related