201210260119 123zgj

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 779

Metadata

Post ID: 123zgj
Title: 201210260119 → 2012-10-26 01:19 on A858's clock
Posted (UTC): 2012-10-26 05:19:37
Timezone: UTC−4 · title 01:19 against posted 05:19 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260119) = e9958dde9ab8f2a25c864e43c16eae33 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(779).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 53 · predicted N = 9 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E54C8A586F13B636 F1659ED078029EA1 04900D04CCB45934 896560E123E478DD 05808298EFA0B873 0276A49942F9B255 68B2B8B90F9E0116 4460D6F453FD2907 ECF1F8479669FB32 B046C98DD6F2A232 D4F3B6354E847743 32B881E19CFE7BD2 6EEF00F74962BB39 38E3A116A2407DA5 8227038FD7D5069C 1E42267614A123B1 036B64F1222500AF A00A8DB78B97DB5A 453C7B00FE38500E 55B5E6CB8DD88DD3 3E7D741405906447 86B32C267636F392 F840A18F8AA827D1 F9E7AF201516BAB9 E7EACDBDFBAC84B0 808FFBAD24BDF0CD 66303A4576124940 6CBA09E16B306A8D 5103037903C461B2 44D1B69833A74DD0 C176279CBFD29AD5 341EB25D3BE3462C 8DC0FF7A5120B269 03B3B98F8224FD44 36BB2E5AEA7EDF2E 61EC50783C53A666 17E2007D8888F421

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260119 (name+title). Key = MD5(password) = e9958dde9ab8f2a25c864e43c16eae33, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ab358506-519e-6081-afeb-d7d769dca3ab
  2 d73dd24e-7c2d-3101-a48e-bf4e04296c74
  3 344d1b81-e961-2b56-9316-2f2db988679b
  4 9dc57188-b33a-7aec-9b9a-a10e0d33f118
  5 289c9b7c-7a36-8e17-a8ba-db43e06f724b
  6 93ad99ea-c8d0-2567-ad51-2ab2b526f425
  7 c7b81ae3-6985-88cd-a667-768266d5a59e
  8 0c8ec7ae-9d61-2d53-9054-1a63ad5576f6
  9 d3f0b9ed-40ba-37f9-8f54-b63e8b4e527d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 632782823. Exactly this sequence comes out of new Random(779).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 53 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related