201210150100 11hye0

explained decrypted filler

seed 385

Metadata

Post ID: 11hye0
Title: 201210150100 → 2012-10-15 01:00 on A858's clock
Posted (UTC): 2012-10-15 05:00:23
Timezone: UTC−4 · title 01:00 against posted 05:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210150100) = b430ae300f12d5aaab22343583435a3d (name+title)
GUIDs: 13
Filler GUID seed: new Random(385).Next(9) ✓ verified
Run: Run 36 (seed 335,015) (seed)
Draw: 26 · predicted N = 13 ✓
Machine boot: 2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 11 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5CC99AEFE2C92938 F9BC0932F3681BB2 3AC78666F3D76ECC E420D2197E4A6C96 CB74F7B054E7F7CC 443ECAA3EA944F39 14D4DA0B8F841B86 5FC3FA98898F60B2 71844E9C40507005 080066402C761FA5 E22DC943A257BCE1 E7209AF2E7C3CE74 762A2A362EAF64FB DFDA1266BAAD5D64 81986967B2E2D65C 83DFDB183D9A3161 906298EF8198A8D1 F3DDEC828AA519EE 144BF903F21DFB1C 5834508A1094756E B2E02E2C4427974F 076710628D7B3981 9E5E137C27F228EC 9ACB330D2D71B9D9 86E5E24062267C39 D3A289F295C1261B 98379977F390B6F6 E16565E2412C4DBB 1911B73C98153D0C 4F7EC8CE96252383 39C9EB2D140FA7E6 45CA746107B0FF88 C7FF9F88CEBAAB63 3E26D935348953B9 ACEB4ACD7F7E3547 9CE416202860859B F9372CA372065583 E46D8E92909F7783 787E7CF11DBAE368 B9315F6B08046298 AD4D0C3A2EF0248E DCB676C1B28590F8 707D02C23B239F4D 43B8E2129FAF6A07 6087DC9CE298197D A8F5652203BC90C4 195275168DBC7435 C8A48C1367151431 9DCDE9CEC7F14525 9BDD3CF7786AD039 D788C39A739F6051 1C102B9968BA8E07 2C4E4B382349E1E0

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210150100 (name+title). Key = MD5(password) = b430ae300f12d5aaab22343583435a3d, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e1c95d47-5196-744c-bb83-4848884876d3
  2 4d55ef43-fe0e-721c-8b9f-f236bd9ade65
  3 52ab7b95-beec-7f2a-a910-6eb510a5975e
  4 c04da373-cbd8-6ae5-a6c5-13638241e64d
  5 fc92cfce-a713-02a4-ac86-b4fff55e3964
  6 acab7c3c-b53e-09db-aee0-d28bfcc9cfb4
  7 77f5350d-8175-39f5-ab04-820e2affc9c6
  8 519ab655-608a-529e-b66d-46579966668e
  9 6981263d-9c20-50de-bdb5-333ad6cf2036
 10 3bb4dbf1-ed56-20ab-9533-dd7aeecc415d
 11 264626b3-17f9-82bd-bd23-95331fed7fc3
 12 68e5556d-83fa-014b-b24a-3aad224807f8
 13 2225cc4a-1f37-257d-868b-d54144a15751

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7776003552802. Exactly this sequence comes out of new Random(385).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 26 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related