201210260035 123xc6

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 572

Metadata

Post ID: 123xc6
Title: 201210260035 → 2012-10-26 00:35 on A858's clock
Posted (UTC): 2012-10-26 04:35:20
Timezone: UTC−4 · title 00:35 against posted 04:35 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260035) = 73e35ef1b768e7846ebd47dd285695e4 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(572).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 31 · predicted N = 8 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F0E4FFFCBC405E4A 53CF7DC2AB6F408D 552DED55C07D8E86 B527C4D4FE6C9CBC 9ACAF0F70DF03EEF 7A5E114D2D9872AE 0862F4994C4A160A 40F750999BD01FEC 9247D7AB5C2CEF5C 14C049EF1BE11729 E4B3E1BF523CD57F EEAA1523E00D19B9 D6B1501C8D6CFF6E 7851F469D4EAD6C5 7E35EB67D851CAD4 4235F3905F917815 1F023C705C5AD88C 30ECC131141B14F7 4AAB31E898DA697A 1B3B0EABDB67DD29 A2561E2727389F27 82BCEC40D5175E92 DAE34D725F36A847 09899834E764C9E9 45C2F4824237D639 97E0E2AAE08A0D2B ECB65F6133E9B413 9BDB8BC1E9A07FA0 25E496ABA5920F4B 266597D358ADEE91 8CEB3109EF621F24 20C9B5DFA5091603 FB91E22B4632A315

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260035 (name+title). Key = MD5(password) = 73e35ef1b768e7846ebd47dd285695e4, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 54399de6-9ca3-4c3d-9a52-f48bc5400c31
  2 855f2544-b579-538f-bd76-82c84d023f68
  3 71dae0af-1eda-534d-bf08-d898f5cda2f8
  4 7f15e7f5-6abe-5c93-bcab-15c1f2dd438f
  5 866cad82-c653-424e-92ed-b5a410660bcd
  6 3aa06431-f44c-32f1-a246-52c7e6b2b59b
  7 0ac95f58-24d8-14ab-8988-5e18d0a18eea
  8 016b1e18-8212-3ac0-8b87-66a54681e338

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 45554313. Exactly this sequence comes out of new Random(572).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 31 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related