201210101000 1185db

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 829

Metadata

Post ID: 1185db
Title: 201210101000 → 2012-10-10 10:00 on A858's clock
Posted (UTC): 2012-10-10 01:00:19
Timezone: UTC+9 · title 10:00 against posted 01:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210101000) = 4420693877c71ad4b07fe1aa9a8807cc (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(829).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 515 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5E83E8F1DF9B7B83 66DB710F5549A91D 2237CD9801EB0A5E 4B71637059FBEBCB 803332DBF0E3C5CC 530CC6A9AFF28EB1 BC01EB03BCF1F808 9B1A60858E521EE9 32AC1AAAF444CBC5 3F0FFCA3BEE5E8A8 609E056498EF2347 606BEBD7AE0BA998 2B13ECDC06D08672 B28DF8899F4A98EA 42E5CBD60DA11745 1396A24ED678B5A3 C71CA81BA7BCCB09 29479C9D8CC4D002 B3A91A2615FFA7EE 0A5266386B3C0CA2 1FB7EDB9034576A5 CC1494A9318842D0 2FC04904588D9A41 2CC5A4620113F47A 0AD6DDF817E79B51 622DAFB831D62C06 0593F905994A7209 5574634B96895014 1928A4B48A048FD0 110C44A95DB039E7 D85A0F0ED40DCD47 D650EAF55CC68D26 011BD64264128F9A F5351F5FBA0C0FD9 763D839011006E7F C0ED0CB5A14D09D8 A9982A9B29849713 CCA6920698475D2E C6EB76C4F2A2DD02 4794361B5A7AC329 A595FDB63D0FF3E1 54642996D9E31A56 ECA9DA3B2FA011A3 5BB4C53D911A89D7 EB18D625B465A685

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210101000 (name+title). Key = MD5(password) = 4420693877c71ad4b07fe1aa9a8807cc, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 43d7cdf5-5e7e-7784-af64-6454b22edc18
  2 37693935-a27d-0b5c-8ef9-2307b3711a37
  3 7dad9771-d1a5-2c08-96cc-6652aa9e596e
  4 f9996b25-d525-4575-8210-a6c643fb34bb
  5 3b849568-2009-46ec-a7f9-63e0a5853fd6
  6 c622dbf7-7601-0298-8707-bc0ef8e3ba9a
  7 272aadcd-7155-391b-a9d5-fa49c247a535
  8 26b148a2-14e7-34eb-b48e-0695aa8f4c29
  9 1aeee64c-47a8-4be4-b948-d86b7651953f
 10 afea00f8-0e18-8ffc-a577-4c8214e63e13
 11 11b3deff-dacb-0057-8f37-9981ec57bc3c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70244033480. Exactly this sequence comes out of new Random(829).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 515 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related