201210050803 10zlts

explained decrypted filler

seed 753

Metadata

Post ID: 10zlts
Title: 201210050803 → 2012-10-05 08:03 on A858's clock
Posted (UTC): 2012-10-05 12:03:10
Timezone: UTC−4 · title 08:03 against posted 12:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050803) = 7bc4c553494ef36941f9f629c19e574a (name+title)
GUIDs: 21
Filler GUID seed: new Random(753).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 228 · predicted N = 21 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FFDAAA8F3355DEA3 E15C82112069EDD3 21FA2E626C3976A3 8426DC96BB2D79B1 090EF2274E7C29D2 E97F7AB407EE249A E81F569E05B2A402 F759932B60F3A074 5847693F94AA249B B1C63C579684D31C 944E385C6EAE384E 3BEB2694EE2E6CF8 C6D86BAE7623954A 4A9D13927195A1F9 73063CE79778D9FA 793BF52CFA25AF5E D4740A45B7B19ABC 5B886D76678D0184 0B38306100A7D405 91686ADC4B475B7F B8B4AFD863C7227A EEF4475C1A48DAF3 5FE313F727C7C935 B6358ADC96861737 DB8AEF7B6FED2B71 D51B2C1C35FE0FF6 18BAFD9553A6C691 AA385A3042E912E9 BE802D15126F3FEB C7A2C85B03329791 B7A6C23FD8EE7BAD B6196AE545B7DC0F 5D7697461766EAA8 360A4F2B77E03395 73CE9541F80F2A0C A1D6CD37E4C8ADE4 8A9342C245368ADF DFE66296BE68A8AA 3A712A076EB05025 A97D3162547EE2D8 21D36EB3C8DE0DEC 1A737EF3CE2D8C48 FF4FC1615148B91D F7AAECDD1CFE4CA3 DDE467E7F3D5E1BC AE02E91FF5DF349F 803F94CD495F9722 1DF97EF1D77A7485 C3F49FD064606A99 B0787CD59AF9A79A 2BE0D533C3C10E73 DF3A6C002E2CAE3B CFE184B0324FC5CE C4817FFB9633B483 FF9AFF5664A0CA15 C0D68BD304AB2CEC 364238172D52B041 96CBF97E684C5B01 96AA01423888C14B 39086D20104890E2 4F0CE6C4B4690CA8 CC2D3931B4CFAC2C 55FB59C1F59327D0 295B5E10D57D92D9 5D18C3C1D12B3820 B643D962FE3777AB 70C8FDC4C312A213 E069D328D2A7141A FEBA73B1D4464E70 C07AA5551FF7A396 6689A6A70ED765A2 B294157C9EC648AD 651680407B2D9855 A001E1DC554EAF41 486754D34C546FBB 3CF7A44FC6DA3E9E 6B507A3D5A2724E4 B9D54748D96710BF E043D137BB527565 A6D832CCC0D115DC 865C6A1F2ADEBF17 5AD66471962677B8 7532008EED842F0F 83175518B7F7AA88 9B240CF62910C92F

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050803 (name+title). Key = MD5(password) = 7bc4c553494ef36941f9f629c19e574a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ca9da20b-7ca5-13d7-b504-e4e48b6c74b1
  2 3fd6f391-c627-67ba-a047-8d04571ba200
  3 101e9705-e267-0a93-854d-492788605399
  4 da12bee6-42cc-2389-bbf8-c034dd456b54
  5 99e37e09-2299-1d5a-9411-4e1dd473aa2a
  6 59352125-de98-5321-a459-49b3ca3da343
  7 ee9bfea3-b04d-2adc-a33a-9287d6dc69cc
  8 87e90f2b-67b8-19f1-8b27-491fe1eec265
  9 75ec954a-9489-15b4-a2c0-0b9fd73d9839
 10 ac435f7d-d99a-8cc1-90b5-d18649dcec54
 11 62956549-67a0-0d0a-a1e8-ea33fac3077e
 12 d40bc52a-9d6d-3181-bac7-0b8024e6515c
 13 282602bb-7f56-2701-bf63-008c7800a1d2
 14 4d3f6020-af10-1b4e-90f7-9da1d97a7321
 15 fbe6536f-ef42-0a06-80e6-7549e79e94fc
 16 f0b0fc69-adf0-2045-865c-0d1c2542cd78
 17 eb1edf8f-16e2-38cf-b6d9-173dc8ebf5eb
 18 00594844-7b37-7ed6-8dea-4bbfd50bce2c
 19 80d5d4f7-9397-0318-9391-fa5216ddca7e
 20 1dd24688-6140-790d-944e-fbad170798ae
 21 f5785499-e2b0-7dc4-9848-5b9c945a01df

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 160215211803210237077. Exactly this sequence comes out of new Random(753).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 228 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related