201210131300 11f4tg

explained decrypted filler

seed 154

Metadata

Post ID: 11f4tg
Title: 201210131300 → 2012-10-13 13:00 on A858's clock
Posted (UTC): 2012-10-13 17:00:17
Timezone: UTC−4 · title 13:00 against posted 17:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210131300) = 47f89476d6eb010e3b22c32a33c87cf7 (name+title)
GUIDs: 11
Filler GUID seed: new Random(154).Next(9) ✓ verified
Run: Run 36 (seed 335,015) (seed)
Draw: 17 · predicted N = 11 ✓
Machine boot: 2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E059AC8D5C1D948F F74DDA0EF892C061 6360B1D83F0ACAA0 E89724295722AE2F 29510B6CDB6C41E7 17CBDA8270347A4A 554B036C80F4301E 6BDF4338DC785D4F F089E01C72768803 8C5DF0057AC6DFCD E3A148D93233124F B882BC3093C56B0B 7C1185D91B94BEB6 CC00058825AA5191 522B5F49278CC1D5 75FDD96A7863F1A0 F838F952A5196D6A 24C2630360AFCA83 5A608928A6B320F8 E67D1974450EF865 414EDC91829404B5 2C42F236882DBEA1 7BD7583930BA38D2 8D9D60021D887D45 97EC363F080D27CE F04A675DB1754AAB 4652825612D33740 0F85C937F4C6C8DD 050DD356A30B61D2 AFC3631075EA09AB 26A8970DACC1F35C A979420B90770F4B 433682B8C79E42C4 35555A3DFFA889C0 16CE2616210B849A EEA63F021517A27A C0AB8FCEC151115B CFDEA5E5442DCE97 FC4E224927EB5441 5DB25CAB884F07EE 7E82AEFB9A76F134 B61FDCDBB1CE2448 9D6C9FF88EA2ED1A 04FA0E8CC5D5FD58 912CC47B581BF897

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210131300 (name+title). Key = MD5(password) = 47f89476d6eb010e3b22c32a33c87cf7, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fa4be367-31eb-1f3c-88dc-e8af2a702794
  2 2fb3e998-7dc9-02ce-be5c-d5266c4d60f0
  3 53676c39-f569-3e93-8fe5-f6fbd8561c81
  4 90b9df03-d3f7-387c-bb93-59c710ae5307
  5 f37f98b5-2c9b-678f-8fa0-a7995e71437e
  6 5a499f37-6c0a-120a-9cc7-7b5ef740e7d7
  7 b40db2ab-2727-8b7e-9b30-aa9130c3c0e6
  8 3a1f5ed8-aadf-69c9-8584-c87c4a536170
  9 0030ff89-c635-0387-9a29-93d6ee23358c
 10 8e403468-94f4-0192-ae38-fc042584c3db
 11 373d2d45-2dbb-6396-97d6-32e0a3ac7163

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 10336186006. Exactly this sequence comes out of new Random(154).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 17 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related