201210071245 113cfg

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 175

Metadata

Post ID: 113cfg
Title: 201210071245 → 2012-10-07 12:45 on A858's clock
Posted (UTC): 2012-10-07 16:45:11
Timezone: UTC−4 · title 12:45 against posted 16:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210071245) = cbadb5c09aff533fea79d1ed638cf3ab (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(175).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 386 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

76F757756D117C54 0E6311CCB3EBA0C3 228626453460A297 439427CAF5E01A54 1B51D86FA138B7E6 46C6CA3A5BB74888 E96F0F991B8F6F8F E437B3E2B80B9841 35AC6E0201A631DA 528A2928267877BE 00926F9C95CB785D 01A03B2EF2DB1AA6 854FFECFE168A10D 42B73BFA51A42042 01E153DA17B038A2 BE094A47208B7C42 12213E88E8A356AB 41E9BC10F89A9AC0 9BD062D53914713A 93E558B45AB62551 3DB93E8DF2873AB1 55728AF86306752E C466D4DB13BBCC13 7B9B975FA386F548 A96E357A0EA11AF0 4EDB63B6E4DD703B A82A9939032DC3A0 FCB6E105BF43D920 66DCC071B5BB8A4D 70F89B9A42FC6163 A8D7BF5CC13CA7DD 1627AC5430B33C9A 00223CBE1CA7A566 86B5C96EDF710C30 B923D8BD8E556468 CB3E3815C5B0F4F0 649A36EA9319207B

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210071245 (name+title). Key = MD5(password) = cbadb5c09aff533fea79d1ed638cf3ab, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3f3698f2-30cd-1986-8e03-b7e5e1a9e192
  2 0e96fadf-1c92-15c6-aaf0-92622b73bcef
  3 8c18b092-9205-06d9-9055-643c8c49f0f5
  4 a018db54-582a-8d22-a24e-65c548669b33
  5 995d507f-0c17-1b49-ab1a-6e8b18bfbc9d
  6 5947b850-7b67-4dde-8408-ba3c65b871de
  7 3dec28c0-2cd4-25c7-aebc-95245960e587
  8 81cfcdf3-002f-26b5-b312-ea3b1367cd8c
  9 dee42a6d-b2a4-5153-b997-faff9d02e1b4

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 110814225. Exactly this sequence comes out of new Random(175).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 386 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related