201209231344 10cksd

explained decrypted filler

3DES(name+title) ECB, 16 GUIDs, seed 236

Metadata

Post ID: 10cksd
Title: 201209231344 → 2012-09-23 13:44 on A858's clock
Posted (UTC): 2012-09-23 17:44:38
Timezone: UTC−4 · title 13:44 against posted 17:44 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231344) = d6059ae9d93662b9b4b00dd7e3d5e114 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(236).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 62 · predicted N = 16 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9DED373601755321 43047C5AFB89E800 1A29C249CA76D7E7 A3D10E4EB8E461EA 54FDB0515D5DCC92 EDA87BDE330984AE D6F30795A7B600CB 4744AD42689BDF0A 9FE0830A25641287 19DC55901336B4D4 58E470C2CB9BCC9E D6F0C1232D673AD4 ECD56E52F89595ED E576650854C15D90 D2884D606FDDE1B6 F83A5BC1189A2752 56C631D5C3B99993 8CC2661E849D9DB8 D869646AE5016768 0EE6102640E9C75C 22C0100DB3F3AA5C 024454A10CC9A352 BDB17277AF4A94D2 276DE67620C2229A F6B74AA44304061A B9335073F224CC48 D490F043B6C20B02 1AB4559B7788BD6C DDD6FFA831FBF5E8 6F61743EB7291C2B AB90AC6E03B04B93 7F8947F1669DD948 FA5F5A49B5AD5A15 7D128EBE96D461D1 431803F83D959809 FB8A97E6953A5C52 1D23BF8A92B3ABD6 B399E0D8E9441739 17C082491747F6E4 F2819D60C7A51B33 F74507DCB92F515B A12B8FEAA8D89804 49A303B28A43551C 3D6A9D7375F15CFF 1584EE5D72BE005E 20560B2BFD45E244 014BCCFADA905E08 FF129EE771D1836F CA38D295A5810C46 630BDA5FAE73D18E 5B61AE3A517D8A30 6217ADD27B5F720F 3AE3723F1B572DA2 72FBBC4B8BDD1CD7 354761D41B8478FB FACEFC7E9924CCB2 404D774B13D33359 919540956D0AD019 4EBCFF105FA09497 7BAB2908D018D1E0 7DE0E07AA53E1250 99A1D6A28CC85DCF B5B5915D664A8378 66BEF4A2F79EB63C 24FBFF64C5B6781A

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231344 (name+title). Key = MD5(password) = d6059ae9d93662b9b4b00dd7e3d5e114, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f43ef198-f6d9-03ef-9f2c-398edcaacf4f
  2 75c17297-0910-0c6e-976d-7796d6aa7ee9
  3 67245a07-d831-6308-807d-041d63147d4b
  4 4f7fb37a-57ff-893b-9f45-a7ced8117bbb
  5 30930d1d-e8d1-61ce-9603-6148a247e2eb
  6 06e9fec3-c07e-7839-877d-363344f9db27
  7 c01c71ff-cb8c-5953-aaee-c5149925f1b1
  8 14e94042-c814-769e-a3d1-769aaf92afe9
  9 bb9757fa-21b0-1694-8cbf-73ae99097c57
 10 1849d50a-1786-294a-ae91-6457ffed1e66
 11 c192e1bb-7dbd-1ca8-abbd-3b4119de84dd
 12 1ea12be8-9492-6ad7-948d-4c74b74a2076
 13 805af125-2a98-7572-9a06-dd4f3f851b9a
 14 5d954518-d481-2a23-acbc-214279624512
 15 5744dedf-6eac-1200-8f15-d40d9f8159df
 16 96391d79-fa3f-36c2-8eab-70862badfb4f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0068675712167213. Exactly this sequence comes out of new Random(236).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 62 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related