201210260007 123vv8

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 666

Metadata

Post ID: 123vv8
Title: 201210260007 → 2012-10-26 00:07 on A858's clock
Posted (UTC): 2012-10-26 04:07:09
Timezone: UTC−4 · title 00:07 against posted 04:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260007) = b54f21e0381e8b760155a017c6681824 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(666).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 17 · predicted N = 14 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

37EC5851405943F3 D13BB3CEFC50F405 BAF955A39D56C604 977B4B88576C3280 D2CFA50B3B0D0CAA 3391510CE098C5B6 763F453F4283B18F 0DA8B8BD49AE0360 05546BA8957AA2F3 6260A4FD7639A3C2 1ACB087871D48D3A ACACC1ED41558ADF 9858590FB2688EC3 90EDBBBFDC4D4810 E7A7303C75EF3A22 DE3AF5077A0713FD EBAB56D92A8A30F9 E4F62728B8BAE751 C82AA6E9885BFBDA 1CD856206352D46A 3DCB0D95BD0D7322 ED0ECB421A2AE27F 3BAB0CA1A72C7ABE CB210D660E808D9B B5DFB643BBD5CDE6 7413620A10E9B3B7 A78161293A48AC08 202DEE1160220E23 FE5167D6D458EF76 E43A694864078E69 F51FC7D4A0C5B783 FD42F4B8B232C45B 46359382762501CB 03BB178679479885 1FAACC9DF2576565 910A32752ED61B8D 91915C0FCC712C22 AE0845CE0ADB6EBF 9AC4DB7970AC9F13 855EFE9B7C8F3707 CBD4663407D202E8 F1DE36F664056D6D C5E1F8EDEC01F0AB D722E935E7260429 F3CC67DA79E2BF82 7816ABC780C0C621 AB587E9CBFF8CA53 C7D9119BBF0CC67D 06AA433AFC18E861 964F5D99CE88C523 96946CC829E0E86F 8C6A29F9C78DEA35 19D2F1405095E9A5 81F7CF3430C38DD9 C4A497BC59ADADD4 D61DF055531DD865 27685886BD342ECC

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260007 (name+title). Key = MD5(password) = b54f21e0381e8b760155a017c6681824, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f94821d3-5b05-537c-9f43-0e51dd11e5bc
  2 ba185ff4-f1ec-2fca-8bd2-20b3e647cab5
  3 75799c80-05c1-2d96-9723-e0fb0d45b4b2
  4 174a223b-1d31-6a1c-b1f5-98abf962d352
  5 ffead180-73bb-85b1-bcf0-7806854996bb
  6 30099bb7-d370-56e9-9f01-00fc3d2095a9
  7 de270c9c-345b-2b4c-ae66-d02da7d81cee
  8 5d2d4e8d-4f59-5fda-b269-05890c6d1ee4
  9 4cbaf385-eb04-3c50-8eec-e36fc56c2272
 10 c7b59aad-efc7-7783-b0c7-cf68a22b325d
 11 d12728b5-744f-812d-82de-a5d2ce30b7d9
 12 6d7bc4b4-6c69-3d89-ad65-7124f033ade9
 13 cff3c6a0-0445-405c-9045-81ec6a3aef80
 14 2fb7d414-1094-8b6c-a9cf-9f7441580f96

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 52268525378348. Exactly this sequence comes out of new Random(666).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 17 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related