201209231309 10civd

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 957

Metadata

Post ID: 10civd
Title: 201209231309 → 2012-09-23 13:09 on A858's clock
Posted (UTC): 2012-09-23 17:09:12
Timezone: UTC−4 · title 13:09 against posted 17:09 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231309) = d882af38eb63b6f51efea908663bbab8 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(957).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 27 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D950595A6E188DD3 8937F89733145BF4 A1DA2811C94BAB16 ADF4288822211A36 A385A24095EEB2AD F5A685A7F56383D4 4E25416F8E52DD08 12EAFF806B2D4C92 15D2212C0953B6E1 6D0221A4EE82CA40 62514EA56BAE313F BD9C5D60A272DABF 128E8A09998B60E2 09C85D01D9007254 636B739A397773DB AEE82EBE96F35035 F22F6086534B791C BBE2BB75C241EEC5 32CA1829E6593B36 6A19E66B70939B47 8C6C202B6D2FE9BD C307E7216C55BB60 1C2A3457EFAA656D 06F3220ECF6C6831 1725E9BABF3A588E 0BE447F851A02736 0E7EE703A3FA79FA BB64FD6EF96ECA08 15925FCE563E6A36 F61ECEC58B703829 38ACA611B6809D13 147FD526D3C16AC1 B026B2CF8C5AEEA3 DE302E1B49142C81 7292B9E0C636C56B EC3497101CE9A4BE B40C98D0C8ACAC6A D9E4499E8001B797 FA679F71F6DC03EB 322933C46F2AE269 9C33AB8977AEC8CB CDAD0770884A92F3 9993E37BF4BFD04C 4F2D0EAF39DBE012 7A4D65BE092F25B6 88C56FC4CADA5F41 4D37EC83C1BE42CF 0062CE1D8D2324AF 126FC73EC4615BC9 E8A9D16A71283C4A 29B5F99F1D6586CD 05FB4105A827BFEE F8887206A70389F3 77035A0C1B19FA0F C4A9E4059E767B3F F3674EAF0A9C550D 94ADA5AD760E21F0 7DD50F6D3B08F147 953A3953CA50CE7A 2B0B2280D82DEAAD F7C42EF21BD1A273 A24392C18BA245DC CE3A4E763FD13CCC 62B0021E94ED66D0 2340D2E6BC34B9AD E398BE50D8CD6C9C 5AE255C4D67E75AE D5AA04D9D6261A10 8444686B854D95E4

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231309 (name+title). Key = MD5(password) = d882af38eb63b6f51efea908663bbab8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5dbe0aba-2ad9-6716-b03a-3411b49999b0
  2 268b15b2-7a99-5eea-8b68-6cd3fa82bbce
  3 ff840163-7452-6923-803e-7c4faf34d1b9
  4 c23c7a53-292a-7ff4-9d63-173598520891
  5 5fd39d23-0a9d-2878-a5ea-5dbc03a549ae
  6 4ad73c01-2c0c-712e-b7f6-b41328d5b145
  7 643988b9-9370-6be0-b87b-4ab2fee51fa1
  8 2869c1ad-2874-4d40-bdb3-3c7d310bf94c
  9 0d777afb-c0f2-30b0-a8d4-609be11d1853
 10 3eebe6c8-043d-17c2-b5b6-412289f49e04
 11 4aabd5df-6fbf-3b92-b6aa-782fd95abb05
 12 299222ae-c377-5fd4-898e-371a7a548577
 13 6ecf3bc7-ff0e-4355-8d30-80bca144f645
 14 ab41df71-9761-344f-b0aa-dbe146a6b372
 15 5a081a01-3070-7a34-aa42-1368f65e4711
 16 492d93c4-2f46-619c-bbf5-603909f35419
 17 5d957040-897a-163b-ba79-17257d7b6e8b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 65672764313543761. Exactly this sequence comes out of new Random(957).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 27 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related