201210110400 119l93

explained decrypted filler

seed 5

Metadata

Post ID: 119l93
Title: 201210110400 → 2012-10-11 04:00 on A858's clock
Posted (UTC): 2012-10-10 19:00:37
Timezone: UTC+9 · title 04:00 against posted 19:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210110400) = 3c68c8ed18849d81c5fadaf76a3199be (name+title)
GUIDs: 12
Filler GUID seed: new Random(5).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 533 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7B0E5C4A025DC777 D0B620604092DB01 5AE433D62B3DCAAA 6C0A64EEFE0B0B7B 072C20CB649517BE 806140BBF27E2D53 D7B762F42722CD23 55861E9D09424ED9 5579F94BA6953D66 E9820137722D035B 37415AD215532A32 0E2E28C22C411176 E79A70774E804469 9BF8AF90B7ABA24B CBCD485D28868274 23CA1D8A73FE079F 8AD6764E1E8C7F2B 9759E4B97D23DC50 B2AE0BEDDA029807 491E0F06735BD591 4BF7802A7DFD213F F2A7B238AD4CCBDB B73CA7617F869EA2 4F048C3C3087D143 8EAE50A95668EED2 AE0F1C9D5AA98C10 C63CF6D8363A9B87 01C2387334FDB0A4 B81E93D1E7C16CD5 1F81C5A4D739CBD5 CBA5DBDC83E33ACE 75232E46720543D0 1F00E9ACD5C2C38D F3CF2A9969F83E6C 3FF15565A49632F7 8A05F34154554B36 509AA9F031D8474A 5BA1A59754EA1347 1BBBF521824C47A6 09BEF5D59A6C752E A96DD67924205A59 205271DA9C43A5F9 5402468A44AC2C21 42FBA26D2D0D69A7 F3B2E40DD5591A8B E5E4438488E18F55 1CA508E916C1FCFF 86E476E76F66D652 4AEA88151F13E99D

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210110400 (name+title). Key = MD5(password) = 3c68c8ed18849d81c5fadaf76a3199be, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e31777bb-b0fc-36ce-beac-689d07fe4494
  2 10d2e39f-5715-2a71-a4c8-60c347974da7
  3 9626b385-e1a6-2317-aca1-482bcf9702d0
  4 e4887e67-b938-5858-a0f0-14bb8153f89b
  5 672d0f93-a6c5-4402-8eb4-bfeb2c50ea7c
  6 3327e9ee-0c87-8184-a8ec-784de8f86eb7
  7 3fdb1ce2-45f9-1553-b333-b717ff4080ae
  8 fbc2b457-75e5-8713-a7ca-61b0213a8616
  9 8301bdc8-84ee-51ca-86f5-0141f735a1a5
 10 fbe74324-b47e-1541-9e38-08d40ad7015d
 11 0db0a362-850c-8909-a24b-c75350e6bfdb
 12 17ea5b56-255f-32ef-ab43-a4e43db77c8e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 322548185183. Exactly this sequence comes out of new Random(5).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 533 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related