201209241319 10dlua

explained decrypted filler

3DES(name+title) ECB, 16 GUIDs, seed 331

Metadata

Post ID: 10dlua
Title: 201209241319 → 2012-09-24 13:19 on A858's clock
Posted (UTC): 2012-09-24 04:19:01
Timezone: UTC+9 · title 13:19 against posted 04:19 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241319) = 4251ce925c0cf93ba4c6c4e1aef14b7b (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(331).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 214 · predicted N = 16 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

44B5C46BCD168441 94066EB0E32E3055 B4B8E81C4F696527 13411C86538BEB7C 18EBE5B028A11035 017DAB4D806D4B46 2780897AB18A393B 76BFE760D1972159 5C1EAD6857F1A1EF 8C30DC9726F00CE7 78B0420E074C761C DBD9BB5C3318C4B1 08F5AC7C7869997C 693491F38B692515 2937916DB435643E 015D732D165905BC 53A13DAE86E13EDB 2CA5A7413C394CE0 8513587F54F0A957 4DC3775BD999CA43 AF8399E8BD9C60D4 F1BBC832123D53FB EA7A139ED0833578 62990656A41FFD40 2370EAE5ADCF9922 4CB649BCD2666AE1 16688A20F715E965 51D7223092A0CF5C B1C808E5972A60E3 C27176D9CA2A7439 8A3DD6687A17E949 73E5EC9DE499023A 5F08B2EA9DD76A16 8B79707133D3B84B 37BD71AAF6299B76 56A7039B8B0FCB99 F6762A10ED6A58CE 9B0B0EA839049DCC A2DA633421F4ED81 18A8037DE4C6BBA7 4C7E84B3F6D99DEE 324EDBE5A6C9B9FA ACEECE6B4708684C 39A2080C6560380B 5E040833FD286D40 A900EA6D8714AAE5 781DDB50CC60DDF8 2F03C07176142181 3BB8F33666430E1A 553DC08D7FBD6A5F 269124C0D9A062CE 80CE92DD226CD4BC FB5166374F467609 E6CAA300C0A27B13 A9A8593376BDAEA6 59CDA04DA0A264C6 ABF32DE6DC81260A 93C70D8F92FE0F89 246B37CC40817441 1F2FD6795D446EB0 76DA21A900BDCF3E 4FA189E1F8036128 DF94E85557C194D4 BB65C10AF317CA6A BDECE719B3F9CFED

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241319 (name+title). Key = MD5(password) = 4251ce925c0cf93ba4c6c4e1aef14b7b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a210a5d1-7ca7-5343-b8e1-14f3d8ebd09a
  2 bed02e8e-2a2a-8abd-9127-f0dd3cc1e93d
  3 d197d094-7a49-1434-a95c-cc957ac056a7
  4 1f9d44c0-2191-161b-b030-1b7c71ff2ae4
  5 445b688b-a681-5a59-b939-e028f85da595
  6 22fb33b9-e4fe-7370-a497-81f7eb983920
  7 28e11119-068c-1c12-a860-b7036275fa55
  8 320cf008-e9e4-406a-bc47-8dcd7f6630f3
  9 aa3568cb-fa13-8e64-9ee3-5045525b190a
 10 d674dd45-dba0-2a54-95a2-24e3ef438135
 11 86386946-1b2c-12d6-a483-3310cea9088b
 12 006892ef-3599-7e94-afb1-dbf7c1d1534d
 13 91a6e8e8-ea88-17f9-a565-db27154ac6a7
 14 5d0c392a-b6b8-6d3f-bcbb-f1ac37ff6a37
 15 eb385ff9-9b73-6234-b7de-916f93dc1cc0
 16 0fcf0f6e-5d42-66b2-b974-ec308180fbee

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5811571482171666. Exactly this sequence comes out of new Random(331).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 214 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related