201209231301 10cif3

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 370

Metadata

Post ID: 10cif3
Title: 201209231301 → 2012-09-23 13:01 on A858's clock
Posted (UTC): 2012-09-23 17:01:05
Timezone: UTC−4 · title 13:01 against posted 17:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231301) = 759fd11c894e1e9fbf6f45044a9c65d8 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(370).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 19 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6870F3381EE60639 F3ADDA1726B9172D CBCA39459D4E9041 070E9738FFC87D96 194A061294FF5879 CEEADC9857813D46 93CFC8B122B8DB9D 45CF342787515572 41F213A7BFB2E612 23F845088167FD5B BB5C2B8FC173D8DF 73A748368A217774 55BDD5DFA911AFAF 9CB1A8779AE7487D 6F88A45E02A5F1A3 9E4EA9760726CAD0 3F20E6756D131E00 989839657A034D91 52EE18EF11BDA05A 011AAECBC0405801 5DE1AAD711768E36 37D3FFCE89952BC2 6C4979CA9E7F34B6 C1E74A8004A8CA98 BA39047096D42A5F 332E5C4EC54C8FF4 8158B5026B758378 F96A9095481D6F99 A3CCA4F933DBAFC3 ABCD44DB15B77F6A AE55B0C45A761060 653488BCB5E472FF F913E5FE74443E17 D2963E9C25CDB304 728CE739D2EB51F9 CE3A1339C2E5029F A848912933A3388E C1DE6FAFCC7E58A7 A1EDC53DC2595532 7BDA72FA4BC80BC6 9589CB270CA9D8CA 92E08DE6FF5C5528 08EEE4BC524839B0 BEA4E290A38B2BBE CDCCE5E2907BA841

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231301 (name+title). Key = MD5(password) = 759fd11c894e1e9fbf6f45044a9c65d8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6a2cbd62-619c-0a5d-8e44-4277bcfbf493
  2 46b023b9-344c-327b-af3a-a59a8ec274c1
  3 4460e0a6-b166-3638-88a2-5566e58195bf
  4 9e8ee2b0-b723-4024-9767-78a6aca000c2
  5 573d7934-21bb-248a-892a-9684d2afb1ff
  6 c60dbf1a-e166-8859-8b68-5ade09ca5075
  7 61911b89-dd4a-66f9-b0c6-99fc75cd2701
  8 ce2cccc3-ab80-0820-b84e-70bbca1cca7f
  9 7f715a8a-fce5-64a7-8b14-ba1ee394f0ad
 10 5a4e1637-4f9e-65d9-99aa-00e416dcd88f
 11 f1a87292-e1b8-7138-8a3f-731cd7f68780

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 03342860667. Exactly this sequence comes out of new Random(370).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related