201209231357 10clhr

explained decrypted filler

3DES(name+title) ECB, 16 GUIDs, seed 233

Metadata

Post ID: 10clhr
Title: 201209231357 → 2012-09-23 13:57 on A858's clock
Posted (UTC): 2012-09-23 17:57:46
Timezone: UTC−4 · title 13:57 against posted 17:57 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231357) = 634fa6f2e433a7ab7234cbf4a79a067a (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(233).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 75 · predicted N = 16 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A6A4A4530CAC3771 ACF8A91FC460720F 831F35ECC48D9258 BF97933E86309EF7 1A15E17407BE2D63 D5D37ECDC4A61206 08CAAB92D7E4E303 F28863173492D4A6 82A1FFCA66686D73 2770EC215F867D85 3C566174BBF2C82A BB50A8D97697779E 608E31D3BEDB86A4 365AEEF4607A9744 A8E8A82D42EAFFB9 95253E2D0BACD2F2 DEAD52CE6870F5E0 59874C1017FC2E26 CAFF5D0E2D7B6289 038AC6BE67AE8E79 8BF5502073306642 32D7281D585ECEAF 1DDCF6FBD0932914 83A841FDC203C18E DCD3238DDF623B19 05973315441103F0 FB0C51B3223F68C3 8A488672A6FC4A85 BDABE68767ACBB4D A6A55DD4404E4F86 682C005E7A5527E4 6C7739470B996FBA 2DA823501922DF96 D60C2385CF4F76C6 72680DF35780CCE7 DEC70C20F5F227C7 D89F4C48421501AD 9E4AA868CB038EA4 0459A6AF58BBCB16 6609189157645736 A21A155B97A650A9 1D64AD6DFA3475E0 B313C9709EE7FA5D B1274C58EA325E3D B74FF458B728C79A 5436FE49CCE1C376 EF55839F03E50A93 82E01229016BFBB4 6BD06D10D6E185A6 B1C8D24B12BCC4DC A0186B4512B4D9F2 6A572DCD70188856 EFF13F7E0425CC41 15D9B4AF5701ED22 222FC6168CDD7D9E EDB03A8DA01B1C78 FA9590B8082CB203 8AC8E6F0DB27A06D BBAB94FA4651CC5E 848673B8E0594887 BCE71B12F95062F0 0BF82DC334B7510D 091DAE4F4D7DC857 9B4D37FD24148D8E 3CA8B419A5AB23DA

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231357 (name+title). Key = MD5(password) = 634fa6f2e433a7ab7234cbf4a79a067a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 89e4bd60-7474-421c-b849-a763953f9d7c
  2 2b02de56-91f7-1206-8834-ad1062ae9534
  3 18671c8c-df8f-5a39-ae27-80d9a0e3515f
  4 9fb54da7-3549-2f66-b936-b5190d885789
  5 587dccd9-68af-32b8-a813-7b9dfd0b72cb
  6 fe64fa9e-9a0c-1d5f-99f8-d8590fe2d9eb
  7 ecebb1b4-2dbd-2f9b-ae3b-fa1b08c436f6
  8 39a01536-30dd-3c9d-8687-9b2c628110b5
  9 31e229e6-5b30-7875-9587-38fc8ec0baf2
 10 4bbc3a5a-1dc4-112e-b6ba-11231f5426c1
 11 9c549836-bb54-8e9c-8875-91953f40d1c3
 12 247176be-2962-3d85-9b9e-2ab0995b0b50
 13 6fc8d0f3-17ad-7de3-85fb-8b3406aa3939
 14 c468039d-a97d-6531-a108-d040c7848895
 15 68989506-a6c8-064d-a1ac-a0c0cebd442e
 16 144e0ba9-5b7e-4dd1-8618-60b9db721988

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4152312371837604. Exactly this sequence comes out of new Random(233).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 75 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related