201209231303 10cijk

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 132

Metadata

Post ID: 10cijk
Title: 201209231303 → 2012-09-23 13:03 on A858's clock
Posted (UTC): 2012-09-23 17:03:06
Timezone: UTC−4 · title 13:03 against posted 17:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231303) = 503d7b5b698e15ad987c0ee9eeca908c (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(132).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 21 · predicted N = 13 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E3AAC607779A6296 5A7311CE1B50E5AD 8719EF30E121DC0D 01AB35C7C839842F 7B8573BA72BDEF5F 21CD8C8A709816DA 60D76D1CF0667732 1A6937DA65E68CEC 8C601AD175658016 1876C2075CDD5AA2 2AF1DDF57FF30201 26742BA7A0628FCF F49AC0C63BD55F2B 968D8F59B914805B 08D9275776E184A5 2049F117F62343CC 55165F3E8CEE0B52 1658510812FF93DC 26F2F14ED9E723B5 18A5413767FF4F22 428CA493DCF84925 97107E85AAD99320 7FA4F34FF9783906 0BBE14F4909CA37A D3A615DE20D14D70 4DA2869FE543C034 4CDFC55E92D8AA5D DFA0F8E23A2FABE9 F0DAC5FEBD40DF82 F011897A5F507629 0CEE927E738AD812 FFD82E6BB047FC2D D82E6CBA8B0C8013 02878B060E2BB258 B00FC216F5D31D66 DC15FDED745B5873 8C192EABFD7C6F75 ABE2015EBE1529FF D114DADF240CFA24 1FFB2F0234A228C7 4123E5258E38385F B83D31B82C34AAC8 9A79972636DDF729 61BF83F9535B3CBB 6A6819D5346753B1 A5B3663009AF7A93 956A01C589D72800 33B259F8BA87AF62 40C6395AC0A28EDA 81B24CA58EB3538C 5B3DC447300BD2B1 0986338776D5BC7B CF9D9580DD416DF7

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231303 (name+title). Key = MD5(password) = 503d7b5b698e15ad987c0ee9eeca908c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 58ab12f7-c72d-69e9-bb70-1fb31be0c889
  2 16812e19-6e69-484a-9707-db79c0e0c74a
  3 e39f4400-e170-0242-886f-3d5274aac82e
  4 92bb8de1-f9e0-6a8f-a10e-bade04f90f20
  5 d4d662c4-db3a-715b-8052-c54368b7dad4
  6 5f3aea1d-935d-8c0c-ba61-f19a55f0ed3e
  7 69a04a79-a8b2-0bc1-b73d-66c7093fcd8c
  8 e1c1a41a-f424-5773-83c1-21041b6d1be7
  9 5f731064-5a1d-216a-a305-68e66c87c9c6
 10 aa562260-2887-8989-9d1e-235cefaa1119
 11 0f50a184-21be-423d-8d83-988b468587c5
 12 4a35f1cf-e7be-40b8-b482-7c0e88e51f1e
 13 40877adc-3476-3a3b-b912-54f8319ac6bb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6406780528443. Exactly this sequence comes out of new Random(132).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 21 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related