201210260101 123yo8

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 450

Metadata

Post ID: 123yo8
Title: 201210260101 → 2012-10-26 01:01 on A858's clock
Posted (UTC): 2012-10-26 05:01:30
Timezone: UTC−4 · title 01:01 against posted 05:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260101) = 7319dffdc33b965c8b20d7670f468229 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(450).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 44 · predicted N = 14 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5F3D5430A876A19A ED7E7867F8C91DB9 126972246B8AE05C 7ED1AB7C7C3B36FD 1083AF08F552D6EC 2D63B2463E85EF01 53AB07488945FD13 6647D975ECCC14F4 38923EFE96F30FB0 A56D88640EB3D43C D3A2D6E7B93EC371 968F27E96E49D0C1 427872DE8C2A8A59 C457918C01861CCE 24BAD529BD5E2630 CEB983C5C09A9A03 5271EDC1BFEA6F75 6DC8479ECDBAAEB8 998208C2E24D47B8 D134F999485205D9 07F1882F8F5CA231 EF4BDD40B35BA4B4 42D508673EE24F9E C6CC5C48485C2230 76A5C5DF3FCD1E4F 1A23414B16651799 094107E06E6838CF 6B96F43D975EEBAD 4B5119EDA45C4223 3E0072AA18E5D911 D5A1927867DA9E6B FEC9CE1182B0EA7B 89D773FF66BE9709 1E3CFCE99F396FC7 4C248F647B889411 8920BC2954BB072D EF2AB32D9529ECF4 66E9BDBF6437A5F9 1D568400761CACE3 FB7A04E4341920E3 519C017DA47579BA 0F77F40A73CA1141 F79D84B408AA61F1 7D5C4E7C03F8BE55 0635B49B39D3C584 925D4465DCFDCD36 0BCDC6E0613C008E AE37AB7FA3C71E5D 04E451ED6EF38DD5 E2EE5A1E6C84C74E 30F1AAAE48AA449A B7A381AA62FBEC4D B10BBCC4604EDCF8 766FEEEAF860AC59 F02881B2E19A9D30 650619B8D6269D5E 7687A5543D0128FF

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260101 (name+title). Key = MD5(password) = 7319dffdc33b965c8b20d7670f468229, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 18375db8-6e70-7dc8-b208-63bb137ba002
  2 7fe68f3c-65c3-7698-96f4-b24b8fb18390
  3 48d635fa-d92e-2ec2-9801-3f4cfa3c37f5
  4 04b8446a-50e4-5c1d-aee0-d71b084502af
  5 532ff146-2484-3995-940e-2274155f955c
  6 6a29173f-119b-7850-a5ba-0d41ab3e5e15
  7 79a857fa-e2c7-45e7-87d4-eebe0e38f6cf
  8 1e7f26a1-8794-13e4-8c0e-5d9e0d09459c
  9 fb4a09e5-72ad-5e25-a05a-dc1ee3e03c01
 10 ce597193-bdf1-140b-83e0-57bda8299fc6
 11 c2b8da46-e875-7ac2-b877-7f1e20ce5485
 12 c1500c1e-ae2c-7103-b11a-877c5aa42270
 13 932123e2-8428-86ba-88e4-bf3f28ea1634
 14 441a708f-a34a-5960-9951-9ff6a18788b0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 77253741517785. Exactly this sequence comes out of new Random(450).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 44 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related