201210260053 123y9g

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 33

Metadata

Post ID: 123y9g
Title: 201210260053 → 2012-10-26 00:53 on A858's clock
Posted (UTC): 2012-10-26 04:53:26
Timezone: UTC−4 · title 00:53 against posted 04:53 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260053) = 09afb94e15c7d95dc0e48d0ae7e5b849 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(33).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 40 · predicted N = 18 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F78839DBF09DE692 2FB71ABDD8D94FF5 CC637FFFEF695021 D7D2B4A19F276D62 B4825D0C39B758E1 3EE4FFF275422F0C 7B0A5AEFB89162FA 184E5195F56F8C69 FB9CE058E1FDB736 034C939E76A6BD11 72FDB95AE2572376 D50A90F27CB0C860 6EF960F623D03C84 0E44A7FCDA69282D 680CDB143997DA35 D04E445FC705EC81 F5DF7047E2AB07F3 37AB11784EAAEB4D 98A14A564B0CBAAD A9EB7ADFF22FFFFE 4B9BCABD27F4B560 E407CE6A70940DC7 40D7A0467F085355 60C776A05CFC2354 9BE520F4D85153D8 D83D8E1E774B0FD0 0E09E501AA140BBF D7D627CA9304720B 1E913E3657715EAD 5A5228CE47BE7FF0 81AE6F01146FABE7 DB936F21557777FA 21D2805CCA71FD02 2E3E7B8526564E21 D0A9002382541EC5 86437F481F6A5104 9197EE25F648CB78 C58B7E529390C280 95D067312F2008BF 803646CE9AC3CDD8 6E78A2D18C95FAB0 BB876A521E4C1E32 8DB5AAD6D25FB0A8 D561F324D5106E5D C9F87D74715FBCA6 38661F125B852CE2 6173E8D34DB05F8E EB4A432EC00021BC 89B0C260748D1A1A 2236C6251D00C879 FCCE62A3A487618D 409652F099E03277 D8D281BDE528C45B F784499D010D7568 7C2961C5D8455394 5430A51AE1EB5430 BA0A84197FA397D7 6136285033FED696 E63A2955620246D9 FC889936052AF191 50018C34E13016FA D4221A13C3748CAB AE82856F90574602 9B9353F0360499A1 AF66A39F25EB6E21 9D5D2F00F7622CF6 A1409CA184AF374F F2DDC5E647E14B93 1839A637D6AB5D8D A8684325F8A9FCF6 812B1319D37B2E61 85FE11532D6D1532 643C0201FC8D1295

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260053 (name+title). Key = MD5(password) = 09afb94e15c7d95dc0e48d0ae7e5b849, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 802c019d-99d4-89fc-a21a-eff1fd9c52d3
  2 2e23440d-95c0-49c3-9f7a-c585e7086639
  3 97146b1a-a6c8-7b55-bfe4-26f95522e0c0
  4 f6f8eefc-1f87-5c4d-a780-7b03473b056f
  5 bbbc57ee-640e-0a77-872a-4e3f2176753e
  6 4d1e8a4f-d2d5-3d94-988d-1367c471c5ea
  7 e4d4857c-b7ff-65f6-93b7-f4d0fc849665
  8 e7964617-58da-835f-8e1d-14ed07f3c038
  9 c0b14e3d-3068-036e-b535-ea302c879416
 10 9bfec55f-d614-3d30-9ca5-9d84d552eaff
 11 967e39fe-ee05-5c4d-9ae5-209bf57208c5
 12 d41d61e9-9c6c-262c-ba71-26dcddca70cf
 13 4daef953-745c-2552-b106-761279d707ad
 14 6b211e24-e626-58b9-8050-ed9817f31985
 15 60aee94d-a044-0383-a8e0-1417a9608db0
 16 bd1ea423-645c-505d-a141-4da41fbe7ce3
 17 e41bb1f2-62b9-6b0b-a198-d68e7a5ee16d
 18 1c85f87b-52ec-4800-9bd0-8d732413c00f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 847503680352250564. Exactly this sequence comes out of new Random(33).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 40 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related