201210081346 115bmm

explained decrypted filler

seed 498

Metadata

Post ID: 115bmm
Title: 201210081346 → 2012-10-08 13:46 on A858's clock
Posted (UTC): 2012-10-08 17:46:13
Timezone: UTC−4 · title 13:46 against posted 17:46 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210081346) = 49ff9b0d9280ff3d967203f88aa4a078 (name+title)
GUIDs: 12
Filler GUID seed: new Random(498).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 461 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

58D9291F33B04EBB 886A979DD7F00E1B 186C10EBB16D3BC8 6BD29EDAAD363FC1 319267CF348AC445 6331637EADF8B430 4F5D87C4A77816E4 5BF001AA8CF22345 B5ED9413750C95EC EC126E50804AB656 CBE70EDE544F234C E4B71219A9E0A201 8EDE564D2AF932B3 369EAFAF64B6D0EC 713C6118165B9977 A8BBCC6445CE818C 43C1F1DD74A69866 9C4363CF27674F1F 974C4F0CF13464D9 655DF2D2A4CCD977 8AA142174F2B976E FA6D0B99E851FC68 D7AA7382A9CB99A9 AE254F839BC0F248 10601AD5E49FE6B0 3AF8A22618A89C57 97A180F278511F9E EE4A4698D3C73ACF BD287F67CBE42B3B 45ECFC20537FBE10 6ECB015825A0F3AF EDC85BA01C9B873F 02E9044B958BA4E5 562D2AC9EB93E759 888319173409D340 5C3341BB20BB1594 198A03B9D873EA85 97DC1DF339E37B59 C8849D7626A3DAE9 0029F6FA9B3087AB AC987D817BA0C44A 34C8B4FE3931955A C552BFB1EBBAB207 95403AF91E71309E 32E162674C2E1006 E1D7B2D873B190DF B97E77714D309DE0 F2B2E9102D5539F4 D2B3E1D62780D64E

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210081346 (name+title). Key = MD5(password) = 49ff9b0d9280ff3d967203f88aa4a078, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0337e461-821e-8a35-8d19-04ebd976911b
  2 96fcd242-24f1-8bf6-b2f1-e1eda717531f
  3 43b96db3-4940-7077-bbf4-037f1ab1c073
  4 be1eba2d-5cec-7b64-8f47-47b6dc7b5b7d
  5 9d72a1ef-4cf0-06c1-b6e6-895929dda74f
  6 18fa0758-6509-66e4-b2fb-ba3cb95d54a6
  7 a1bd2746-7205-0ea5-befc-59ee30671443
  8 555a2963-cccb-2b77-9df3-e0fcd92756b4
  9 d29057e5-03ed-5975-9895-34936ccf84b3
 10 5aacb468-e457-827b-be6a-25617c3b1513
 11 ef3da702-3984-1595-8e99-5d2af0307838
 12 31296cff-a16f-2b16-b787-446915850158

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 887706025812. Exactly this sequence comes out of new Random(498).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 461 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related