201209241401 10eihw

explained decrypted filler

3DES(name+title) ECB, 16 GUIDs, seed 659

Metadata

Post ID: 10eihw
Title: 201209241401 → 2012-09-24 14:01 on A858's clock
Posted (UTC): 2012-09-24 18:01:01
Timezone: UTC−4 · title 14:01 against posted 18:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241401) = 966d6350f27b0e23273941ce3b0b1ee4 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(659).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 226 · predicted N = 16 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4DA74BF49AAC84E9 F1B1AFDC06028D07 5FFEF6A7FA6F682A 519113946677966C 82B6246838F888BF B4B13F204E2D014F 6D99C410C81A3B55 B97E7D206AE4A6D5 4859C9D19AF7914F 1D207FF009F33771 D0B45D9DD380B135 C248AD550CCE3CEF 81643C8B7DD1E93E 8B83D2F4FE38CF6F 85E37AFAC79A946A 7633E72CF347101D 9D2BAD074094B9CB 2866259DADB7E4E2 7039C926A6311FD8 8931FB2CEDE67A8C DDA7B201D9679319 FDB6469B7D84D6AE F454F528C99EF243 7DBDB067B9DB1551 940D35841CD1D561 6CC5338884FCB595 EF36EFC6A0D282C3 ECA7C700F9A14E57 B5BF432D69114C35 2E32FEA77D2873ED 5BA48A1126F5AB18 84CB63C8C001BBFC AD18CD96762B7B18 DF936E8B66AA1F8D 210D4692CD1462D1 6D1FC8A68D2D2EEB DA3B211621D1B9F3 0B4220DF25004EC0 1397B61069CE6166 E6FBE9FBB53592AD 6E54082367201F04 16DA2FED9356FDD7 FB5B25F556862201 BF8F684C0A3B4548 339B305E84E59708 F38A4D40877D1188 0A78E61989CCCA6A FB94C41F766B921F 950D2B857C1A80D1 B319972E4428E9AB 4882972A14BCD9B9 586736FB1A5317A6 F409FCF84BE9CB3E A446D4510A078533 ABF4F14A436460A9 EEA28B6960C0D299 591D65560774B72E B39C90A4E7DE2B15 C0089423F0774E09 1EF0541947D1EFE0 F829BEC19E900B3D BDAB2710FC1E5EFC 24015B73313F91B3 153F472B7C10CF24 4EE100F0065F693D

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241401 (name+title). Key = MD5(password) = 966d6350f27b0e23273941ce3b0b1ee4, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fe7345b3-7df3-09e1-b360-bc68da661cd8
  2 18cd8033-8d24-14be-ba08-c4a2edea9ab1
  3 aee4c708-545a-3872-b5ee-8026abd466ee
  4 6ab3ebec-6f98-111d-914b-af5d504500b8
  5 f2b66dc9-0c22-6214-86d1-985f5c5b0087
  6 6ccec1e3-aaa9-444f-8bb5-f31a78304d5d
  7 29f155c2-3b3a-1f2c-91d7-a6f5e8583fad
  8 2379d247-fb5b-09fc-a7f7-a6601d1d6122
  9 8b7141c6-650e-466f-ab31-5e433004ac43
 10 a84c484a-0b92-2f21-ae49-d8c05021fe11
 11 7bf913b3-2298-7ae1-9516-c2b0672e2b40
 12 e95a4b3a-96a8-8927-8da5-5dfdcf75581f
 13 3ea580fd-9567-577b-9ac6-921a4a2ceeb0
 14 f99b35af-ce9d-248d-a4f0-e8830a965243
 15 01643605-01db-2fb3-975a-9a3a32c99ba8
 16 2dd958ad-41d7-5f22-8b70-7ed8380f4be8

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0131641042785225. Exactly this sequence comes out of new Random(659).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 226 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related