201210260137 12409g

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 522

Metadata

Post ID: 12409g
Title: 201210260137 → 2012-10-26 01:37 on A858's clock
Posted (UTC): 2012-10-26 05:37:47
Timezone: UTC−4 · title 01:37 against posted 05:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260137) = 86d53a0ba355fceeed306a83f6286983 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(522).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 62 · predicted N = 8 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6CA5120B80EA525D 1825EA3C33239B5C 42A06C9818A97DD3 A8B8CBE6E3E25DA0 7D84B703D06AA2E7 BF93DFCC15CA054B ABB7938D9A43B538 357C0B605957BFDF 43D6D092D82D0E6E A74DAC3B1C54FDD4 DC9E2E9E6E279A6F 54C9B7CCDAAD9E1F 93AE658FB7DCBAC7 9A1F20CB2919662E FD72E2B325F6F5FC AEB0278B3F7D607F 46009A85FE5EC556 411FF8942DB3F7B4 58589A07A1AF68B8 825A2C25FB23E64F 361DF6E044D300CD 51E9AB8667D09016 5648D95193833E33 D758E0D08621E218 39CDB3F2A47C7584 62B80A9469591573 88887A413B5EAF03 017388D768E8E185 41B41680D06789ED 3A68ABB88379D5EE 7B7F5AF604D0B19C 25E2FE4013AB5B2E 7203AAB282E41CAE

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260137 (name+title). Key = MD5(password) = 86d53a0ba355fceeed306a83f6286983, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c4bc62da-6fc5-3c8f-9744-9b31b71cb45e
  2 4b7a47cb-1543-8d70-bc0c-49daed2dcb17
  3 d08ea7ef-4c19-5003-a12c-c426386b2b15
  4 22e91679-802d-88d2-90d4-795c0e026abe
  5 87a8a0f1-fd00-78ea-9a7d-efd6d150ea44
  6 b12c3635-3422-6e53-ac02-68a79c11df24
  7 f36a7825-d718-798f-a424-0cd3e97be93d
  8 e822fd29-8772-2f65-bc6b-f3ea94d73196

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 38587672. Exactly this sequence comes out of new Random(522).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 62 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related