201210150900 11ibvk

explained decrypted filler

seed 670

Metadata

Post ID: 11ibvk
Title: 201210150900 → 2012-10-15 09:00 on A858's clock
Posted (UTC): 2012-10-15 13:00:24
Timezone: UTC−4 · title 09:00 against posted 13:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210150900) = 68ac888e8de7dc99dbdcb33ef21bdf6c (name+title)
GUIDs: 10
Filler GUID seed: new Random(670).Next(9) ✓ verified
Run: Run 36 (seed 335,015) (seed)
Draw: 28 · predicted N = 10 ✓
Machine boot: 2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 15 · 5
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

66510E41D681CD08 13811A33307CC429 5DDC6A258EB23B46 7B6422C868497F37 0C56F44DB4807E10 465F00FA749E37F3 1FDB98E365EF8D17 B2BEE6D7CDCE599F B232C683C1003969 3028CA9EC61A598F 1F7E6E029230F2C2 F818F3353969E040 7EB9257CB69E8B5B 858B2E14B18DF8DE 1C03DA7F7476CB52 DC144C83EF0D23CA BDB21F88B75A6CE7 DA21EAB4530432F4 E5E112E6326F326D 1A3C60EA9BA3B729 802AAA2A2C865A06 A6D1CF0BA8557575 ACC0BFCA6E683E1C 70F3C6A029E62D5F B6C9977053E73F42 BB516DC8612D6065 DA22B6CAD286222C 88586D6DE619495E 15C018FDF6EE1785 24E3541A726BC35B D4DF1E1C6D0F4280 3B0DB103CCDD52EB 76B39E9DFE37819C 7CD62F62204466D7 3466BB7BD2CB3790 FCDC905741B7AFA4 7B183D91E99CD4F9 4AF0605192F91B97 4E165483015FA7B9 97086027806EF7C4 DF45F3BE6CCDE206

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210150900 (name+title). Key = MD5(password) = 68ac888e8de7dc99dbdcb33ef21bdf6c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c816913c-25d0-6d19-bd85-3237fcd845b6
  2 e8d9f6dd-e67c-3e19-979d-29b13b58e84f
  3 654fd12c-2540-0ba1-9530-21fa21bfb3e7
  4 edc5caa3-de1a-562f-be21-b1a3a66e216c
  5 458fba4c-1e75-6389-bb0e-7fc2e5d6c6ca
  6 6f79b9f1-52cb-0081-90dc-59c1356fe341
  7 a08e8bdb-3aea-0fb0-a4bd-d8f3c6b73802
  8 1255f768-9d9e-52a5-8043-ddfaa589fb55
  9 1cd4033e-07c7-7b82-aa29-c2b97a01155a
 10 7562819b-fa37-3aad-a65a-e0a0033377cd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6305600573. Exactly this sequence comes out of new Random(670).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 28 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related