201210260051 123y5k

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 146

Metadata

Post ID: 123y5k
Title: 201210260051 → 2012-10-26 00:51 on A858's clock
Posted (UTC): 2012-10-26 04:51:25
Timezone: UTC−4 · title 00:51 against posted 04:51 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260051) = 455686568e41068870a5a873d4136e37 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(146).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 39 · predicted N = 10 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

95D94913995B80D7 5728F90681F8882C 89C3E47BC4F04638 A00DA1B7E0CBF50B 65A9A7740DF0C08B 760E197F2AD4B7B7 F454825243B0EEF6 56DB26E55695395B 4562A2216AA5ABE9 338E20548710E9B3 D44A0B7139286D5B CA1D7A6B4CEAC74B F706379E51E8BE2E E7CCEAC62BC9E948 2C3FB882F167A1BD 0B80CA0349CDE9D3 DAAB41902988EC10 681976394B502FD4 E82B16DF21C729B0 49A7C4F46EF7114E 71223585C164D1A4 3684C73EE841338D E347E164012B9F6A 2E91AB3F119209C4 8569AE0CE3721BD7 F8FB2651877D8219 9F2D3ECAD7C89BE8 6C9167893EE8BCCA 78D06A533D44B442 AC9F3CE0E49B1FB2 56F0C2E0757B660E F286614C93349572 F72ADE244F4B1EB4 61567964AB251837 6E179F4BA9AF48DF 60C2C0F8EDAC63A7 D44E4298761CD519 652F0B8C6C638E78 07721DF20964ED0A E94984F7B4A54012 1D362DBF27D17346

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260051 (name+title). Key = MD5(password) = 455686568e41068870a5a873d4136e37, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b2edac21-baeb-084e-9fa1-c1d44e0f7e91
  2 b9bdb622-7b64-564a-8fec-6f0613ca5915
  3 e4fc50fd-a26f-705a-8323-b55bb2c19491
  4 75b6c35c-da44-695c-b264-562cb35bd915
  5 4f343afa-6797-1a9a-8d59-6509b8d6593c
  6 5fcc5b7c-5469-1c08-be2f-2ef137e0eee6
  7 0eb5013b-c8eb-2bb9-8147-018b5d3e573e
  8 a19b3b70-8e97-6805-9095-973c05c8d427
  9 8a4e3d17-32ce-0f9f-99ae-3aeaa8af7e22
 10 498eeaff-0286-177f-92de-c9d549edc02e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0576112601. Exactly this sequence comes out of new Random(146).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 39 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related