201210101659 119t94

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 982

Metadata

Post ID: 119t94
Title: 201210101659 → 2012-10-10 16:59 on A858's clock
Posted (UTC): 2012-10-10 21:00:01
Timezone: UTC−4 · title 16:59 against posted 21:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210101659) = 6272369d27007772f06e4ca410224829 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(982).Next(9) ✓ verified
Run: Run 36 (seed 335,015) (seed)
Draw: 0 · predicted N = 10 ✓
Machine boot: 2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DEE27BED0C5373CC 498AF740A5E84ABE 56BCFCB08BBA3FA7 094D146B6E0AFECF 30C80B1C005E6515 9D5B741AB047C994 32D0E1C49B067B4F 8CC9727BC0E22BD3 5E6E15026C0196C0 1933C44D1668AD2D E64D60F66F807138 8F51A19894407BC5 3A8918F99B5D8A00 C95CC86CF68C52D3 5039EA2445EC8756 750D7775C69F4DFE 9BB096E46297F2CE A1C4F51624945819 E0F8AFA20B374267 207209291A931216 3EA03E2A22C88AF3 C60BCB5EC41F75AA A1FF2058B061CAFE E67D689A526B069A 54AE5CC3A644DF64 8AED4B136036DF95 C5FAB908F325D8FF 3A2C86358D49E9DB 819AD55B69D1D874 42AB17120589C300 104383D3E2E8A106 67C3AAE89E9B3AB0 7B0182CFD5B44443 676C2F2CB424F666 678798880DC2A4CB 9A042538F5A670FB A81836FDD9613DC1 0A0F6E3FFEC98C07 1CB4996E7F05998F E741256550D1AEE5 32EEA94EFDC99A01

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210101659 (name+title). Key = MD5(password) = 6272369d27007772f06e4ca410224829, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f5173b51-ee3b-6c5b-a0ff-12c1f670b3ce
  2 8c647a56-a196-8038-b821-1133b876d613
  3 11bff28b-6120-1b1e-b499-293af26004f6
  4 30709a24-9351-1d9c-8c2f-1e7e66ff5bf4
  5 25c1e4ab-e19d-5f68-ad82-897e5e4d9dc0
  6 465f73c2-b219-6d1e-8f47-0d620d9f3ccd
  7 9fcd5f03-5025-8952-82af-dc4cf90d3c93
  8 2f2b5b1f-bd8f-0639-b4a2-f43d169bbf6d
  9 6c09034c-dfae-4279-afda-5345442d00b6
 10 de399900-07f0-3a24-8596-afd3f1470a93

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6811568043. Exactly this sequence comes out of new Random(982).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related