201209231456 10coqo

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 865

Metadata

Post ID: 10coqo
Title: 201209231456 → 2012-09-23 14:56 on A858's clock
Posted (UTC): 2012-09-23 18:56:25
Timezone: UTC−4 · title 14:56 against posted 18:56 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231456) = 269bae12eb6c4e8407ef8e0fa5bcfacb (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(865).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 133 · predicted N = 13 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

218EB04639629246 A0806D61B0DBC737 154CAB4E11A10734 37B360C26A7A7222 07F605F24D4DA670 749EC0665FA34907 F9F33C9899819103 4F859E4544032C63 EDB648936EDDB3AD 8DB2450CBEC8EAE7 46EAF52C7F196675 E7B747FD70B40AF3 3C4253684144850C CBE24A5EF4C6E4B8 8BA191EEA1677E0D E3196BDEDBC1BE21 724FA1335D8D1890 7E21B97878888DB3 E63764C491A9F2C4 34343A3D412808A3 A33DF467452C10D4 F8A9B4C1D56FC1E9 EEAA8D097019F4C4 5716AD4ED6CA752B 81FF6376B5948E43 43D8ED0B2C4787B3 0F9A8D6DA70F2343 D71CCD8FF3048345 8011931329411045 5233D4B7020B1A3E F257263A94C73739 2E62E5D3ACEBB5BC 7591BCF9FD59AD5B BA70588500B1C0C4 0F606E9001122D2E 37C6E45A2D34FA0F 8CE0093151FB9DC0 1AA6EAF2F9684F09 94966F6E73D0B4C5 022C3BBF8BBA82E7 C18ADA5D0450CB07 EF36E48B8056F1EE 918AEAD3CEE2A6B9 A6DE2EA52400E3E0 D70A71C365B76033 16455336C62E4286 A76E2BB5F826721A 8DF982E1481F2AAD AD7872C2F1F8E50C 9DA050A878F37708 090418C0DFB0BFF8 0E92B2E69DAA56C1 B2A409A981A767AE

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231456 (name+title). Key = MD5(password) = 269bae12eb6c4e8407ef8e0fa5bcfacb, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e8bb7e21-3a3f-50ba-b638-1e8f88da462f
  2 622a9ff1-3326-5630-938b-54f2b4fed3f3
  3 e614a12d-bc1a-340f-9330-1392f17a60aa
  4 7d87a363-7d73-17e8-b20d-428aa4ea0b40
  5 85a8e1bb-a398-6343-be76-8203b2c38430
  6 38e82005-bbc9-4317-9cfc-4e56caba2aad
  7 c2601b39-396b-4144-8e49-f4ff83807d6e
  8 1f1f7763-7b64-3d19-af22-7150de78d80c
  9 8f0e76e0-48ec-89c3-84e6-0e4c30f6d6d2
 10 2132bed2-7f54-24ff-9e8c-90bda4ce9ef0
 11 622f1b9c-c8ac-5a59-a97a-de7438f5041e
 12 ef4fe6e6-217e-71f1-87d7-184ebb8fadc1
 13 39324ea5-584d-241b-add5-44aadf4168fc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5531644382572. Exactly this sequence comes out of new Random(865).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 133 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related