201209231406 10clzz

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 706

Metadata

Post ID: 10clzz
Title: 201209231406 → 2012-09-23 14:06 on A858's clock
Posted (UTC): 2012-09-23 18:06:52
Timezone: UTC−4 · title 14:06 against posted 18:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231406) = 527fa290d52d6e079df9528515825ac6 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(706).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 84 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

565F4A6F6B247501 DE14B6557296A92E B27E4C71E2F51BA0 216A69332BFBA880 ED33B4B1CE478371 4715F253F23F6D25 9A5DA05BB67F0F20 C6386C6EFF3BE514 435AE0BC83A2183C 55BF3470F639F5AC 3ED4AE7C1E2FFE16 4B35F63F21EFEA94 362EAACBF74D1419 B012BB7DF8E82165 1861F0FDE3CD4881 C073DF1BF48574D2 8FEF9A585C84BFA6 A6D03847218A0D8F D1B587420773DCA1 C517353BD921F8C3 34BD074C4A2C14C6 9B741201E99CD652 11C862DFE21CC7F0 37E3E0351E9A7118 A4C88D26F41370A8 8F3959EA2324EE39 A5C239C85BD9C4AC 066733A622F78994 E71D923E6D0C6DE2 F35B56D0FA4D4DC8 3D9722FD817513C9 19ADD1AFE6524630 4AB11406DFF75BEB 21CFDF89A4312A09 D08CB07709DB411B 87E3B03B0F55DA9D 33EA5ACB382BBF8C 43D252EA381C6776 0D4C39867AFE0ED2 483AA7EDA1B94030 3C15279CF08A1A7E 99D36EE8B3CBB7CD A82CE11C7FB551A4 F28D869C1565ACA0 48F72F6821513863 DBCEA568584451C3 01EAB5666859D8CF DCA460D1E80B422C 4B1F6629C2BE9399 62B008BC2C54C894 1A28A92467AA77DB 2150A8B69F77157F D94BACC1B537B360 2BC13B1BA9771E74 3B4075B1652DE493 DEE896E9FB2A8746 A1A90FFE60F3D194 D9C0A0DCF9EFCD41 129DF98ACD03D750 71595F31BB7ADF92 B8C2D26D1870F8E0 6BA9B0C3E6C0C065 28A2D8EA7639C62C 79724F994533A3FF E3D3CB3F1822A612 8ECF7EA0C38D6F5D 8EE8D71CF13F3AE0 A50690C26B965DF7 42FDA7C8C0E47666 3ACBB609D039B616 E7D3D1F99A2955A0 48BCE53765EB8D8E 9DFE4E18D9A9ACD2

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231406 (name+title). Key = MD5(password) = 527fa290d52d6e079df9528515825ac6, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bf5fc0e5-c3ef-5507-bb2a-fa598d16b1a1
  2 51831d75-e379-87c3-b922-b33d4280641d
  3 ec160e7f-9d24-29e0-b993-5110687131ec
  4 f8120148-8c1e-2f38-bc97-2d115d44628c
  5 87e2f472-429c-8499-b0ff-bfb6434885a5
  6 b37696b6-1d52-4ff5-82ab-c327197c242e
  7 d8e448d8-fa22-2ca0-ba17-aead4912a26d
  8 2b791959-f033-530b-b6c7-80c261f48841
  9 8bb36626-e571-2a3f-8914-9ca12f57f749
 10 7644fac9-beac-5e79-9188-77fdb4645326
 11 8176e616-a408-32c2-b6f8-510682db2b40
 12 3ded4245-0993-5405-94f7-d1aa395e59b3
 13 eb67c671-300b-8ed6-8008-d09d50e1ca69
 14 7387c614-77c3-66f6-801e-147bdd066e18
 15 336ec351-f8a7-1b72-831a-96a436aef187
 16 72a0b288-9181-8874-af8f-c39d8b437eed
 17 5ebdbd46-ea12-541c-bb7e-56f09567d87a
 18 87bb82b0-21c7-67e7-a5c4-93ada859d31c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 582284252535861856. Exactly this sequence comes out of new Random(706).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 84 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related