201210221400 11vrbj

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 90

Metadata

Post ID: 11vrbj
Title: 201210221400 → 2012-10-22 14:00 on A858's clock
Posted (UTC): 2012-10-22 05:00:07
Timezone: UTC+9 · title 14:00 against posted 05:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210221400) = 05269827c1f8ec1d72f401d8ff152df6 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(90).Next(9) ✓ verified
Run: Run 37 (seed 425,468,968) (seed)
Draw: 19 · predicted N = 9 ✓
Machine boot: 2012-10-10 14:48–22:48 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FF788969D8C3F338 14194D8A13401C89 DDE836C7D118A38D 2CAD690E23317145 4A213B24EA132400 63A27014CA74F9F1 7CBC84F807FE50DD 9EEC519391E1D4A5 52E2A42581E06A15 E639CAE3F4AF54CC 5DE1C19F0FFEB199 E1F2D954CB2B4345 719B847C866A8BEF CFFD43200049C024 9EF110FB4A3D4D75 E5CAF391678ADDC5 D8D6D0ED381225B1 EBEFC6C052F61E3F C22C3E6CC30312FA 58DBF07DBBF3247C 13CE97A5FF6191EC 399D26F0137CCFD3 00FBA3C7A004473E 4468C4260EEFA030 8576ADCBC236CC4B 8916C18D5A4EDD70 9A12EF36725F5398 9F67815C6F989D73 AED2BC047D67E590 C3846175803B4CB5 164A43E6699E9E57 40D9A186F487E9AB 07F3B38ADCC88E3D D12F6DB06E116C02 969136A4E942B597 A5D9B2FA480BDACC 71B5164800E98BBB

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210221400 (name+title). Key = MD5(password) = 05269827c1f8ec1d72f401d8ff152df6, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 26aba9ee-88f8-670a-9e70-f9fce4f4886e
  2 facfb882-b776-2058-b6b6-600a95b29e33
  3 2848cbe0-44de-615c-b4cb-1e88208bafe2
  4 35ce1a64-50e5-6147-ba35-9a26e6094a05
  5 ed82d3d3-f62d-70d7-82d1-57d911faac72
  6 32e240da-341d-1933-b29a-f167c4e14957
  7 ee668b64-8169-28b1-8533-fe8b8a7b8545
  8 7c42af84-702c-5439-a152-395b698c18a2
  9 993ff382-a756-16dc-9766-02d153aac1ad

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 626671251. Exactly this sequence comes out of new Random(90).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 37 (seed 425,468,968): new Random(425468968), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 14:48–22:48).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related