201210251423 122tmj

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 254

Metadata

Post ID: 122tmj
Title: 201210251423 → 2012-10-25 14:23 on A858's clock
Posted (UTC): 2012-10-25 18:23:01
Timezone: UTC−4 · title 14:23 against posted 18:23 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210251423) = fb49c3a8fb7ab31746b0492773ad5359 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(254).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 5 · predicted N = 10 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

66B5DB6D9C7A0338 28EE412B340605EF 35ADFC2F11EE2ACF 6284923F1B32878C 34137B63CC287B5A A6BCC0981682C8AC 61F932CF4C7D6C59 E2FDE2A6D2185433 0C056D503E24CF94 74600749019CB6A3 652AC38303A839E3 B931D255F0949ACE 46DC6FC33E82E206 0AB311ACDDCAA698 DE568E46A611F9B0 2CE1D938F81917CF 9243232FBAEC93ED 2382B4E5D2265FFC 7EC53E3C2D126E54 CEA54F0514E6F8EC 8F8268EDFA1ACB9A DF1CBA10391B2B72 9DA965F79B4443FE 2350A71AAB89E184 D0EBF2DA1A26DC60 8BF2B2E2E99933DB 093A2F98906FA0B6 7F2A37B1BC059B8F EBD442027FDE8946 477C0ED1AE1DD45D 637EB696AF6715D7 4760F0673339E632 A49E6C9A0988ACE1 8126030ECC3E51FA 8A08E32E4AF6D8CF 1E4353C7BF68C445 0C7A18790FC567E6 D6AE719F88DAB4ED 785C0957F1110641 8D610805CCC177C6 58046FD142472E44

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210251423 (name+title). Key = MD5(password) = fb49c3a8fb7ab31746b0492773ad5359, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 89e8f656-029a-36a9-9703-cbb10f043bc3
  2 fd4b0a8b-5a51-35b1-b695-abb90251a9c2
  3 78328260-381c-2555-863d-7aba4f1a3b5d
  4 eb52abf2-a2de-6a90-aa8b-f8d2fd0edb91
  5 4a01d0c9-10f3-7b39-92eb-c851a2c2fca6
  6 a303bf87-2bc4-4c79-9c51-2e8386205efc
  7 4fa51fe8-0ba6-67b2-8bf9-c9933fa85c35
  8 7e0c4b6f-4042-7387-8a14-72dd3a32fadc
  9 c156c197-5179-38c1-ae38-96cde692ba0d
 10 c01e424f-ac99-88db-8c37-d8235d5832c6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3326746738. Exactly this sequence comes out of new Random(254).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related