201210260059 123ykf

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 327

Metadata

Post ID: 123ykf
Title: 201210260059 → 2012-10-26 00:59 on A858's clock
Posted (UTC): 2012-10-26 04:59:29
Timezone: UTC−4 · title 00:59 against posted 04:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260059) = bccad5982d7f588841b4605b4b192768 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(327).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 43 · predicted N = 10 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

917DCC1439ED9011 10D3DDF32AEC2AB1 EE80BAF38C13002F 66ADAA84B498B018 F44641FB033ECD41 27070698C1F31FA5 43C156811DB877CA 44D5058D6101D07E 7B2B0F2587CC2648 3EA6147E27C02181 F2029B771B503C3F 6D17B2E96B4F5DBB B45E7F6C680F540A F4E14E01A317EAF2 F8FAB48022EBA3EE D63C3751A20C2EB5 A494890C031DEF9D 090E58603493D5E0 4CEEF5969F11E848 B67549BF1F6FBBF8 9F36E57A67F9552F 9AD9EFC1DBA74C72 F8EF515600038A52 5294A57F0FF084A1 E6B85F298F741962 80BAE7B011F3F637 C0A03EEC69EC4198 855A1734EF7C5AD0 DAEA1DC39F694048 9B27C87092A7C09F D88A2B6E96E16E27 4D9C0A5F767CB0FF DC28FEBD8998F152 D5A34FEB69B158F2 D52C563A589FE314 054275BCC9BC94D7 6F54AF58DF780082 26160197EF03FEDF 41A3F21C43A8498C FD02B2F47B9CE4C2 8E4367F29CADF7DC

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260059 (name+title). Key = MD5(password) = bccad5982d7f588841b4605b4b192768, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4fd717a2-498d-5a00-8386-abcb4d29ecfa
  2 c235419d-5eb2-6701-b3bc-73aabea106b7
  3 d2ce5afb-764b-3154-bc21-6b35831fe837
  4 cea0c828-4b31-39a5-a4cf-cd85f6ded330
  5 835255a3-1d46-72f8-9acb-9f044bdb34b5
  6 0c7d0736-9db5-2f3f-96c0-4e4c21e3bca2
  7 4e486c59-07c7-38ba-ad11-3b2be57630e3
  8 76003ac9-9c52-49c4-999c-7451d5611cbb
  9 af98c3d0-2202-3a94-b187-fa704c2f4813
 10 ca4d649b-64b8-7b06-b5d8-dcc90eb53987

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5633723437. Exactly this sequence comes out of new Random(327).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 43 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related