201209231455 10cop5

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 975

Metadata

Post ID: 10cop5
Title: 201209231455 → 2012-09-23 14:55 on A858's clock
Posted (UTC): 2012-09-23 18:55:24
Timezone: UTC−4 · title 14:55 against posted 18:55 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231455) = 012cfcde672b7880e9c337c782900fa9 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(975).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 132 · predicted N = 13 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E6F7B65FD1DC0727 90FF9CA9545E362C 43FF5ED2F617A42A A5EA151666C38C4F F61BA0D7F32CED9C 7A5B82E41499B9BC C8EC60E016C71F94 20FB13F12C37139A DA88D320685284E9 BA68E3040D2935DF 6C55D5529A71F308 9C249C8C0BC8091A 93EEB06C4638A168 F8CEF895313E2D29 1238F85AB7EE75C5 E9F59593BCFFB155 E932B3C979A43105 D952330633970F54 542ACB6F4F778F51 9878C20F156E414E 9450FD1C96720151 970F6D0268DB6D02 C6136516EE2BEC1E A1B9960DD03445F6 7308BB0EBC95536D 4EAEA4BF3F7F908C C072B972C8639E79 EC56FB6B59F04F70 CAD3524B8A683E24 CE9B5A3841BB1A66 31092FD6A5EDA514 7A68A83855EECA09 66A766B4D788B753 5A5FBE871F306208 A4905204887CB5E1 87302396452DF468 C503AB655E2B9D06 F7E9D7FE01086E4E B1F2BC0EA369B4A4 5FE97B976F7FD5A0 A5E1F45118FA2C80 4B4DC6F665318D0A 0C7F53A0B286201A 96C87F00001F6CF3 3C80D882BB83A601 175B895E73460A2F 5E235E4CD0E4863D 7624F7AAAC07CDDF A63C45B759889431 E82B3E162DBF7056 C58DD4CE70EC4FEC BBEF7B8DEB33EEF0 4B5AD46B4646102B

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231455 (name+title). Key = MD5(password) = 012cfcde672b7880e9c337c782900fa9, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 38c36cd7-fa29-049c-b218-10a260e52ebd
  2 4383b803-8de3-8e23-a53e-2854b8ebc8f2
  3 57bb28e8-d11f-281e-bf64-74ffd555dc56
  4 f3cb09b7-01fa-561d-bad8-3de938a5892c
  5 26d47d30-ecf3-34e3-b499-c9e8781b6e8c
  6 d9bc1153-f1c2-5e62-806d-68acd5697210
  7 9db64fbb-d33a-6ff0-b9ac-a7069b7b5aa0
  8 50e71886-de82-5c51-b934-a9fa24e518e2
  9 dc37750c-5964-50d4-b15d-a809c6e54db6
 10 0f8e577c-fb3b-7ea5-9e1c-4adbd1e76d40
 11 9a29f4fe-7bcc-539d-88bd-8e993ea0d8e7
 12 f52d5ce9-1fd1-51e3-a523-ca27ee2e1234
 13 96199ca6-3e47-8752-8147-379011a76506

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0825356557558. Exactly this sequence comes out of new Random(975).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 132 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related