201210060103 1114co

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 424

Metadata

Post ID: 1114co
Title: 201210060103 → 2012-10-06 01:03 on A858's clock
Posted (UTC): 2012-10-06 05:03:51
Timezone: UTC−4 · title 01:03 against posted 05:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210060103) = 632fd80503865e617217d08a4de1e891 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(424).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 279 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5B0526D024980585 0F3E7A6C85EBC1A9 1A05CE5CA4A77864 D92AF3A5349F2E96 0246695F5E779E24 AB509C1F8B131E69 DA6239E7A829B0EA C5A8CA79F12EFF72 C86035B0AC4FB165 AE1FEF0F3D1B9347 083995919C879EE2 C8C0500BC559DA4D C52125E0AA532CB3 13D62F1C77B6997D 6F66434F03F3D647 75BEFD4D56A62475 3CD0B7BDB3753FF3 F80B161266EA252B F2D0ED0051ACE45C 7917C4DA9B2A2A10 73C1113F8E51D4A9 F18D647AECEDA560 EC5F3C48D963B957 34AB82606F133122 E317AFC91BF68925 EC4D64E751D45CA7 B5324FD0853ECFEF 6BC6F5EEF3F317F6 F656BF0E045F9947 545B1158BB305953 0B161D4B02EB6CC2 9C64BDF39C56682B 4092373BEB519EB2 53C9FFF9AE90439C D004281D05E081B7 E40431B010AEBB39 3E3785CEBB0ACCAB A3895B8A34A7D775 492FE916D121DC18 CE1CDC14F77A1101 70D9B138F9A97BFA DCD0E1FD17F51220 3F9CA125A1CB7DFE F880EFB662B6EB2A A5571DCAF64A25F0

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210060103 (name+title). Key = MD5(password) = 632fd80503865e617217d08a4de1e891, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2541699a-70e3-259f-bf52-d9544eb6df0b
  2 1be0ea73-69d8-204f-9534-1f165ea3577c
  3 f61169c3-1057-1dea-8d21-bcc70bc4dbe0
  4 f95105e7-d078-0c92-a3b6-f60cd58b5478
  5 7d5ca457-8bdc-51f4-a987-af0085d25622
  6 65788227-00a3-0e02-b254-7c9ce5447630
  7 5863389a-4c08-772f-99f8-da1a7ccff427
  8 d92703f1-4b6d-1d52-b884-c62c6c64c8fe
  9 24535d20-7c79-3582-8624-8fbda4ba8c4b
 10 470c7ef7-2f00-5a5c-87be-ace2ad7954bb
 11 c2f760ab-bfc9-593c-abed-1b548134ff74

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 22105071355. Exactly this sequence comes out of new Random(424).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 279 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related