201209231259 10cicz

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 903

Metadata

Post ID: 10cicz
Title: 201209231259 → 2012-09-23 12:59 on A858's clock
Posted (UTC): 2012-09-23 17:00:01
Timezone: UTC−4 · title 12:59 against posted 17:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231259) = b7ab1398e311d2130883625ec11f747b (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(903).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 18 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2E34F7D2AFE661B2 1087DD9CC3184682 E683A7D78857BD30 60C6A8D1F860B336 38DA39F4F3389293 148F6866259ED4EF 9F5F2A77690A2538 7C55BC183F6A7FBA DB144EDB39E9FE68 CA194C5DA707581A 25F6BF658E2E9FF0 1CDE1E2B5C2EB2FB E9E9322C0C26BD7A E0795F45C551877C 0802B8F7FD90B7CD 456A15579EA06B51 DD78E091BCEDBEC6 C7ABA5E6FAAB2C2A E1EE1393924E431E 4436F61AFBBD3746 468B63C4FE786724 9281DCB3CBEFF0B2 4A972765FBCEA748 C282FF3263B156EC 1D979749000A53F0 09CC6B2BAE659519 B023574B1E2235B4 222FA753811FFC93 BC5BF898BEE28338 17CE87973C9DDC26 783944E1A2635FE8 0530218115388F1F C62C49854301DC2B F69C4587EFF47B2E 1A620251F3689147 6892804B001E6FAC 5CB3307C052AB730 5A25837B5DD3F2DB 5AE72DF3B873B54E 82642A3D09FCBFCD 71619C8DAC3D3A5F 90A6ABD6ACA9FD71 3F5B3192F091622B 9257C22963E8AC95 3E7217CA09D5AF7B 52E114D2714686C6 897AB993A24A65E7 B0AB50D1F3360E75 1EDA054414827829 3A5F539844484AE9 2937D33FA278DAEC 8C25DE82BB71551D 040940BC9FC18523 7FF7C1CE698BB34D 7FD652F92A1AF4EF 4F998740E6432723 23E5472C86F8000E 1770A2AAA5966340 FF554E6AE1345231 DD07B937C6D3C7AD 7BB131A105FA0401

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231259 (name+title). Key = MD5(password) = b7ab1398e311d2130883625ec11f747b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 82e06dd6-7b66-4bc2-b6fb-5646273eadb5
  2 d52d9f21-94a3-62f9-b1ec-2764c682cff3
  3 b319af6a-b304-88d0-954b-e00d73b113af
  4 124fe20a-1a9b-28ae-9dd9-faab1adee9fe
  5 f135070d-2be8-8bf9-b8a9-7f69b5e334ef
  6 e122dfc9-5a71-6646-8c69-bd641594e8b7
  7 7b73d1d4-b3aa-493e-80e7-d0ed3edf36da
  8 769efa48-e509-48bd-97e7-b042545ba6c9
  9 93710eb1-adb6-6936-9440-a66252fd9bd6
 10 58fcca9a-de65-211b-8db5-358d6265129e
 11 224f160c-c091-556e-95c7-48bdd524ea74
 12 8696f195-059e-4007-a9f0-a107def55b3a
 13 1b0377ce-acbf-3d84-bb25-e3df77c90212
 14 fae45cee-2b43-260e-bf84-ede4a0fbdc5b
 15 aea809df-20cc-0f05-a613-7e1e0b107422

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 468286446254320. Exactly this sequence comes out of new Random(903).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 18 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related