201210260143 1240i3

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 968

Metadata

Post ID: 1240i3
Title: 201210260143 → 2012-10-26 01:43 on A858's clock
Posted (UTC): 2012-10-26 05:43:49
Timezone: UTC−4 · title 01:43 against posted 05:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260143) = 149d22e2d47b242b15e705fba5083f5e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(968).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 65 · predicted N = 12 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1E48CF5860B95DC2 46FB39D740114206 15BFAAB97FFD06DC A5EA5B5159C6F50B 68535E1CD6F6F293 2254E84914390058 52BCAD0D170A99CD BCEF30C1D4361806 E9877F6D1797A44F 5E529B8E2B6485F0 285FE03C94DABC02 3C454BD48379B726 A0A74E6ECEAAAC58 309F2F27ACFD1A59 0B58762D7549CFDF DFE20E62A315A70B C7F3B22B577DA4D4 4B0B7A4216BE7FDE 598E249962DDE9F8 3CCD160C7242C2AC 302F7800E9E1A3D8 96597547DC688936 9BCFB77E1414EAE7 9250C4F71F98B952 226C01F666DD777D F32F7333789DA6A3 C43B73E33698C726 AF2FE855CC3083F2 BF7121AF07201F59 F15ECAB7045422A5 17F18F0FB6069BA5 1C0507C03ADA0D44 6CDC930AAB5CA68D 84D7650E95DF5D96 A9CD34650AEA3FE2 1C7C8449C43F305A 33C6F0ED450FC89D E8360F798FC2DAA4 CC65AF125CADA9AE F88039B13D93F67E 8EA0A107AFF9603A 1BD3B8BE6AB0E4CD BA4716A79C2D1DCA 7E32CC76CB4ACD84 19C09628BB4DC02F 3DBF5EE94CFA73A0 B224B297EA1D14AD A157D705857FDE97 211FB85821EA9751

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260143 (name+title). Key = MD5(password) = 149d22e2d47b242b15e705fba5083f5e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b1cf0e71-5c62-3264-ac1d-4635309d65f4
  2 36e309c8-463b-713f-a961-52b20be2fb65
  3 58537f12-4d5f-3b06-a9cb-44f18fddca43
  4 eeb71d34-6cea-1dd2-8110-1ca8e210aff4
  5 c0a705d0-3b79-2454-9c63-20fa68e4cbee
  6 10f42628-0cc7-4977-ada9-130ad2b35212
  7 c2497089-2c17-572d-9ac4-4e8428282b22
  8 43386731-d665-0985-8c8d-e3db5242aa41
  9 c33207c9-67b9-60d5-9062-c4b16ce73d23
 10 b1f22d5e-b82e-2401-ad19-08e9923880c2
 11 657838ea-0152-46ba-81e4-6c0d0ba81212
 12 2e253346-75d7-1d25-a999-14b9eebedab1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 373124506241. Exactly this sequence comes out of new Random(968).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 65 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related