201210252357 123vbf

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 653

Metadata

Post ID: 123vbf
Title: 201210252357 → 2012-10-25 23:57 on A858's clock
Posted (UTC): 2012-10-26 03:57:05
Timezone: UTC−4 · title 23:57 against posted 03:57 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210252357) = 3c0407345f43bccf65d6f711b77d7e91 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(653).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 12 · predicted N = 8 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

683CEB2B5788AB48 808AD11CEBA1FF5A BC0885FCF1EC8AA4 9F0282E784F59429 830946C94B2ABEEF 98F07C7907FA1414 3749AF2B2C20E15C 2EDFB48BC0DF79A8 6159D29FFF3ECFD4 FEB41D1676F234B0 882819F744FA8912 F3EE709FED3CEF82 B07D5BA14C343E53 086A2DB8BDB48FFF 4F1CD66F53BA939E 88F7288156196B18 71823E3EB7599331 BF081CEE2D344538 F9F603E28974149A 87F77DF6D090032C 49F5CCA757F00A3D 6DC7742F1351E15C 8140614FF6D01273 96C4DF542A7BB2AB 26AD024CC2F7EEBD 232CDD0C39E09042 CD988B769AEB81B4 BB4AB14F5243FD40 518E1FC7A058924E FE9AF69F7F964A10 DFAAA63D724BF680 E1D3670BC53A5FA8 DB9960CB6C5B61B5

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210252357 (name+title). Key = MD5(password) = 3c0407345f43bccf65d6f711b77d7e91, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ba7cbd38-527e-7f3d-8956-fec182ee02a8
  2 7251174c-a727-3e44-aaef-2beefe412bd8
  3 c1d812d4-009c-1c89-9456-dac0e6b375b3
  4 6c40fa15-be1c-8eac-8a04-bde637507752
  5 02caa1d7-4aaa-0feb-b325-2dcb79625954
  6 f42cb589-b5ab-1d4a-a51e-d22f8ef861cd
  7 c2f3c573-fd50-4ec4-897f-7b763dbca212
  8 73ca56cd-1e8a-0370-b0d2-55eeee0164d7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 73180140. Exactly this sequence comes out of new Random(653).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 12 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related