201210072225 1148lm

explained decrypted filler

seed 448

Metadata

Post ID: 1148lm
Title: 201210072225 → 2012-10-07 22:25 on A858's clock
Posted (UTC): 2012-10-08 02:25:37
Timezone: UTC−4 · title 22:25 against posted 02:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210072225) = e04a80a20d6b9a7bcb6088b6af907717 (name+title)
GUIDs: 12
Filler GUID seed: new Random(448).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 415 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 10 · 4
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B451DD9A7485D1AD C021E93442BE8C54 15CFEBB2E25AAB72 F62EB0D60AE1C39A A114DA14CEBA6B7F DDF36A4842356302 B8BD934EE35067D5 55D84DAF5131EAF3 37079DD25C0A3A80 7E3D4B0D4AB29BBE 61965A1ED6BA7A19 42DB45CEE2B31C1F 5859564D55785BB3 E7618FB5A42D90CC 783A93560FF58573 DB355703A06D396F 374C8EB70943FEC5 C8D909F706F7BFC8 35C2B55553588157 3C8A9758E68EAEEC 5227A655E1E8A737 5AA72D24D3555F4D 1C2EDC4385E9BDA5 A6C8C1283DAC6775 94575948732F0192 7C90C6B1BFD02FB3 330DDE3E42300F35 CC4DEF63B138428C BCE852EB91102100 0528F51200439D8C 50274297ECC842BB C2E6D081C90FAC44 15D1C07DA0B8A126 6CFE5EFB4B604393 67F322739EBAE9B6 BCF01699510A8737 FB196D5D88C63A8A FE4871DC58E7D586 2353D75BF9B55D7C 21ED05DDA836087F 73B5E48D227A1B36 2B9B1EAB5BAA8D7C 12914DE5376076A6 65A0D5E63317B5AE BCE724299C48240A EAD5E48C86390988 7C345FEC1BAED080 1B4EBE5F07F385CC 35D41D5488BEBD76

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210072225 (name+title). Key = MD5(password) = e04a80a20d6b9a7bcb6088b6af907717, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c7e677f6-cc88-6737-a76a-df8d32540535
  2 d98e7a84-a613-2a8d-a0b0-7f8009ccc3ef
  3 01a10f33-90d1-8bdb-8bb8-f97460865629
  4 51a73fbe-d536-1969-bbb1-c8dad9cf9755
  5 72f1083a-7f82-41a8-9140-f65850bd212d
  6 f06f4279-ce2c-0f43-b7b1-bab8db67a402
  7 04848c47-d54a-5ccb-ae82-42ff63f37350
  8 ffb4b837-fa38-1c89-b899-e32226cb3210
  9 36b65cf4-121d-3051-8025-09ed7b2806cb
 10 253b7d5c-4cf6-4792-83cb-513e259f407c
 11 2d4ee039-8f3c-3e4c-9258-5eda01f20ec8
 12 316eb503-5a6d-218b-928d-8bf44b4b73d8

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 628140513432. Exactly this sequence comes out of new Random(448).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 415 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related