201210051823 110kqm

explained decrypted filler

seed 332

Metadata

Post ID: 110kqm
Title: 201210051823 → 2012-10-05 18:23 on A858's clock
Posted (UTC): 2012-10-05 22:23:32
Timezone: UTC−4 · title 18:23 against posted 22:23 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210051823) = f74281be47072a1a56ccfb89f6f0b0e3 (name+title)
GUIDs: 9
Filler GUID seed: new Random(332).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 259 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AAC26BF296518D0D EE2FD5A2A0A98BC7 AE48A72D83E57118 F3BD0E768CFE7705 D0F8AC78ED3798BE 10C1796B555BCF46 19C631049ADEEEF0 2FB8B2D9AE10C123 542FE1ACAC5EA08A 64B1D296AE9E21F7 BB38A2F6200141E1 5B682801EDA2C6AC 2F6449655C0E85E0 43B373CA3255347D 50EEE742A1278E92 5827C2C775926A0C E85BEABCE55F112C F6112FD5F2E26BD7 0B266D41241E90AA 15E615DFE72EF22F 651143AB3F7409FA 09A4A7469FB7355C 5BD9D97C2E747A7B FA11EE664AB369AE 2EA8B5AF17E0D7D3 D680467254B82F7C EBC6014A7B0A63C3 5CCBE43C0E9DDEEC 32181FA25673C41B B517F365A403E679 3ED66E79480C22DA ECD686F19EE34F4D 3342DA104723544D A54AAEBF0BB049F8 BF55B215B3B64A41 B2689E4C186D711C 52AE6F605BA110E1

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210051823 (name+title). Key = MD5(password) = f74281be47072a1a56ccfb89f6f0b0e3, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 351465ad-0ef9-12fa-b025-7f082d5a3b26
  2 49ea4b38-30de-2f78-a0ee-84092ddc74fb
  3 0f13ef16-dd24-7a49-9a70-bf26b5aa7c3a
  4 f2b7b197-9b78-3b09-9589-75a6ff54d1b6
  5 2f731d0b-88b6-07ac-84c0-5916c8be345f
  6 384f0d85-6a5f-62bf-ad35-b6fdca85b05d
  7 db98ae97-4cca-5a86-a7cf-e7b18be32d6b
  8 85427afc-9416-0071-a4ac-f3f8e0b1e658
  9 0a8dd9f2-ddbd-0abf-ada0-8990b51fae54

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 127306500. Exactly this sequence comes out of new Random(332).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 259 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related