201108071521 jbucr

explained decrypted manual

Pre-automation masked GUID list: 10 GUIDs, seed 494. 3DES, key MD5(name).

Metadata

Post ID: jbucr
Title: 201108071521 → 2011-08-07 15:21 on A858's clock
Posted (UTC): 2011-08-07 22:21:40
Timezone: UTC−7 · title 15:21 against posted 22:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 688 hex characters · 344 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Its decrypted list is ordinary filler (seed 494), not a hidden message. (new results)
GUIDs: 10
Filler GUID seed: new Random(494).Next(9) ✓ verified
Run: Before the scheduler (pre-automation)
Draw
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 31 · 8
Tags: pre-automation2011Encrypted masked GUID listmanualkey: namerun: pre-automationfound by this project

From the post to its content

As posted (encrypted)

701A8F4228904587 7331B6FBCCA81D5B 634097306856080E 275695EAA6646C76 7EBAB29910A183E1 73B4BCA108AB6FB3 A8C880D6AA6F7816 0FD424F4FDDF5D59 D70897050836F197 542ABFE546ED51DD A2BA07D1DAD855CB D4D3940D6B273186 3CAA9D48F834889F F26BA6AE313A5D50 BD0DA060B6D34452 450BB3EC292EEEB7 8DC139FF9A286424 A7B69DEDB7381910 91E8110F52D41ADD 890BAD677A9423D8 D3B6F851671D92E9 9130B05D2E82291C 86EE1CBA32F50252 6173ADFC0C77C781 FB69AD61DDFD3433 C71BE802BCC5C62C D4CAAFB84694CDB0 038F617B8636BFFA F787F9EC3F5E8080 DE53B6F7A34982F5 414E6AD036871809 4354AE7BA2BAF051 B638A884403929FE 1A27A433C5EDA82B 61C5F4A9A1072DAE 08DD33953557F52C 954B628CEDA3A58B EE12132873CD7225 E36206B79DC81B28 9DF40709BF5F94B1 F9FFFD400ED2E845 07FC3DBB9B29D917 554EDD165665C22E

Read the ciphertext. Strip whitespace: 688 hex characters = 344 bytes = 43 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dc06dc92-a310-7cd3-915b-992bcbf68ba3
  2 5663f93b-2fde-6603-9148-5c64c5557f2a
  3 03ee5a7f-9c16-0eb8-8463-8f42e9ed9371
  4 f9911683-5aae-8bfc-93a5-f20bd311e52c
  5 9a26d923-9c4a-29ff-896d-113ed2ce0fee
  6 afbfce6a-bbe6-2ab2-9247-96bdf5aa5b23
  7 835c8aa0-1e42-20ef-a11f-19e8ab90ed49
  8 c66a7465-14e0-2b2f-81c7-54b2ceb4f808
  9 51abd0f4-0379-0ed1-8080-60d958495e7c
 10 68908be4-473e-3636-b16e-a799b00146b1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7608222203. Exactly this sequence comes out of new Random(494).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. Grouped in Before the scheduler: before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit
Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method: MD5(name) ECB
Result: seed 494
Explanation: Pre-cutover filler under MD5(name) ECB; before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit; list seed 494 from the GUID masks (seed 494)
Re-checked: 3DES MD5(name) -> masked GUIDs

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Solution summary

Related