201210051203 10zx7y

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 872

Metadata

Post ID: 10zx7y
Title: 201210051203 → 2012-10-05 12:03 on A858's clock
Posted (UTC): 2012-10-05 16:03:18
Timezone: UTC−4 · title 12:03 against posted 16:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210051203) = 28f9fe87c21c7c694d59f535ed713737 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(872).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 240 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

47E520934690D5CD 40790123410E393C A8F04D529B9992A8 099B87B9878612F2 9FADBA67826CC068 458017B315DCC21D 73554E224DDA141C D9ADE3FA3617E085 2783AF90057B6134 8F2B44B68C8CFC70 CC29DD38E5F37E30 AC7E28EB8FA7B1AC 0E2F90A254A5B2A7 8063FCEDF087FCBE B1C1833B92269840 30B2AAA3F3032F2A 481DDBD9E1DEF870 C5340617CBA2B690 49F228410D80675A 690DEB900339A817 89738D83DA7B1CC1 5DFBA20E9B6B0E9B FDD89CE4386FDC4E 227B8E402FA6C181 E97CC69ED7DEEB5E 15438278EA34ACA3 C25C06494ED1DCEA 9425846E56ED0B7E D0BCDC55189D9DFB 2FB843D7ACD1DC3B 6414EC42577F075E 8B5035E3EEA17557 C6200FB2234AE830 E6CBBC5076C70BCC AD22F96131066F90 E7B024FA25499CA3 011C6FB42F2BD333

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210051203 (name+title). Key = MD5(password) = 28f9fe87c21c7c694d59f535ed713737, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d73d46d8-a2da-26f7-8e45-afd2c08f7019
  2 d05cc70d-c848-6128-bce5-1845b86efa8c
  3 ce63c0ad-81d1-2860-9a7c-29bc204beb1f
  4 8fc680e2-d991-6248-9918-899c6d990503
  5 6e578fdb-24bc-8380-8959-73aa93f34bae
  6 3c2d7d86-f67a-5dd4-883a-40023a7d72d3
  7 a478a809-b5b0-5e46-8b1f-69469b930fa4
  8 0325a32b-fa66-8f93-9c6a-f341eed04950
  9 459089f4-a8c9-742b-8982-8704721d90dc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 262685587. Exactly this sequence comes out of new Random(872).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 240 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related