201210260109 123z19

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 987

Metadata

Post ID: 123z19
Title: 201210260109 → 2012-10-26 01:09 on A858's clock
Posted (UTC): 2012-10-26 05:09:33
Timezone: UTC−4 · title 01:09 against posted 05:09 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260109) = 4999ca0af1c64e18c7c83ae92af63ce7 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(987).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 48 · predicted N = 12 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4C1322BBA0002315 055112E3DD85082D 98373C02307292B1 3276559BE8CE9B82 7BCFBE3C0D9D5AAC F3A907C81B857BB9 A63EB675A7BEAD1B BDBEACFBCD009874 D07EEEEF385B43D8 CC2EE044A4F70B83 F2431767C0519F8C 6528202DC0A14E73 D218DAE1F142AA59 873E9AA83063FA1C E437FE3A2A2BEB8E CDB53AD67777DCB1 79670BDF8B21A0A3 4C211A9EBB8A4D13 EC79BC69A5083539 82837BF96B110022 11CFC056F2566FC1 194709BCE502AB82 ADC7CCDAE8C35BCB 3670D652D09B89A3 C5FC99E96BE02EF7 94EBD1070DE06946 80EC0A7E9A3C3B70 104F159EB0A5A6CF D2507ED02DC57504 58DEA2F4971DCCF9 C52B85ED2F94F6FB 4C51F247D12204EC 0BAEBC8048D430FD 8B326DBFB9A1B014 D91E4DCA5DD07291 B559EC71ECB3F471 980E061A2054AFB8 4907DEBC43645051 35FD2302F366E000 944D578B5B0D3B75 8E543416B891514D D6BE670F4000DE0D 1C0DD990478494FE 9FC348053B2D3BFF 5D17BEB8FCC64894 E3795454770D96C1 6C8012EC19ACF370 5868808CEB9E10AA B28C34A3B6B4BE6B

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260109 (name+title). Key = MD5(password) = 4999ca0af1c64e18c7c83ae92af63ce7, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7116cb2f-de7e-31da-b98e-d7dcb2a54a43
  2 77582f9c-b8a8-3966-a687-dacfb3ec8420
  3 bdc1a279-ea4b-6c3b-a55a-03626a3b9a2f
  4 d12e0055-58a9-2fc0-8e03-7b74b953d5f9
  5 06ee5228-7bb3-7481-b408-966565af9f39
  6 0ba83cc4-e5dd-0d4f-b594-c018df23571f
  7 ce92784e-e19d-1741-8680-08cb96f7de93
  8 9502ca9d-d211-54cb-9dcc-9d846f4d6c1b
  9 54ec1d4a-db28-0488-8d79-668543607d84
 10 a4c3b774-d9d3-203b-afce-85213e3c6430
 11 bab0acd1-e6bd-4e3a-9afc-7524c938a6ed
 12 f3213e74-d316-0d19-8fee-9988b738d5a5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 336270150240. Exactly this sequence comes out of new Random(987).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 48 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related