201210081706 115oqq

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 368

Metadata

Post ID: 115oqq
Title: 201210081706 → 2012-10-08 17:06 on A858's clock
Posted (UTC): 2012-10-08 21:06:28
Timezone: UTC−4 · title 17:06 against posted 21:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210081706) = 48754fc1d0fd1f7504a306d8b6ca5602 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(368).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 471 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CABA3B86215927D2 78E64188387DEEAC 51B9AAD4DCF023C6 7B2519C5D76FF3EB CB25458F7D30D892 8717523946930057 7D9A26CE593E1820 BCC712A77DBBE159 C4A9ACB81715B558 C42F7D8421E23CF2 10FEAACC3888F5B3 AAC8B1B20C2297D7 09FC238EC80F14C6 D0D0241F4A1A3AAA A2A0674D4395C581 391C6A217B2E9395 42ABA09339B03C60 F4889E482860F495 DA76729BC225E8BC 08FCDC8CE9321F22 CEB0339244BE2606 7F3172B923BF131A 7242F4656EB60CBF C67E6CBDD396E7DE 3DF07FECD4234053 CFA285D1625EE601 FF7F3265A7E89E98 AA1E5F9B77AC94E4 F91F16F96DABAD59 1C6486589A9201AE EB2854B3C59AC445 EC7B3365C53D3ED6 BCA2A152BB0F470B 55A1603883D41203 6EF39E737579F206 F2D80D47780A4E2A A4AB690E4DCF170A

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210081706 (name+title). Key = MD5(password) = 48754fc1d0fd1f7504a306d8b6ca5602, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 566742ee-b488-81d4-8c30-01688ae47bb6
  2 7108a123-4ac4-7b7d-bbf6-574a18faea28
  3 816260a3-1b5a-8d59-ba4d-c9d92d8281b1
  4 fb364eb2-696a-0eb4-8798-a509d597ca29
  5 65b52c08-c630-3114-a16a-1289697c3e91
  6 1110d8e1-f019-1bdf-a64a-e783f54ab0dd
  7 7252951e-e424-7bed-a6f7-439c4fd33033
  8 8ecd693e-76f8-01b0-9f32-3e4986a81274
  9 926ca12d-1b74-40ea-a104-babfb3ef5525

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 878031704. Exactly this sequence comes out of new Random(368).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 471 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related