201209241422 10ejrw

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 781

Metadata

Post ID: 10ejrw
Title: 201209241422 → 2012-09-24 14:22 on A858's clock
Posted (UTC): 2012-09-24 18:22:19
Timezone: UTC−4 · title 14:22 against posted 18:22 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241422) = 47ea5f88e5711023e7eda8f401ec11a7 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(781).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 247 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

09E9343A7E2CE548 3A0B7D72CCFDD21E A7FB4A2E0CD9D94D 44C936CB44A06082 39CCA96AD694E4FC E3AC0264256D16B2 716457F178010EAA 59B7B7AB26225B93 2797C05BFBE6F17C 80BDA85669D2F9EE EC102C1D5E6DE241 BE1912234565304D 648204621C1108CF FAC2E8A37706C75C 00843373F1486270 339E82F50F3CFFB4 70AB6093CB249468 CB3F5F24B555B385 7EDAAC45E2764AC7 E068F4B554982171 890FC99DC8200054 C856CE315605C184 466A4E932B3EFBBB 90414ED6D00CC287 DF8FB30CDF1D5315 012FFCB6FD110FB8 05ADB7A42C75E566 D6C5F8EED82B8DB6 CC9BE38885710BBB F76F567884FF8DD7 20EE3E4E6AA5C84A C4669D99413420DC 76F430D32F857DE5 8DDAC713010D22EF 2D3CB91BF15ABF09 2D04FE195DCAD171 574B63BEC8300CC9 D0EE491D645FEA1C DAC5A535A09D9D59 945950E1E03E33FC 601109C48A281904 2CCA3ED5AE41EB0B 5B77519BD163A948 237E1E0F235498AC CCB0D53478083999 DA2462631441FDAE B4639D76CAA8F09B 4505050501FEF2D8 DEC63C74B5C108D4 5E653691FB842E32 21DD86988BA57709 E4F5FD0EE6A5AC10 F9FB23C8663417EF 90C6A42F5DE7DAAA 7AECECA80E8E0D1F 195EFDF5F3B45D14 F74272A4218A7B5B B4A738E6D70A3C25 0A673D6129631D76 09370E9B2683058F 4AC640AB3F9EC058 7F21B845DC3C9ECA EB654E24CFC64231 6861C55CD09D8A93 A51D6D68255BBC13 451657BCA5592915 D2BCFB685E85348B 6D7AD4AE47856611 A607D2115FB915E4

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241422 (name+title). Key = MD5(password) = 47ea5f88e5711023e7eda8f401ec11a7, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 75f5d287-388c-6865-a5e9-b48cd35aaffd
  2 e09218f9-64fd-8fae-bae9-85e25bf6a37b
  3 896c2986-8460-6b49-8810-65d5bb2deb57
  4 b9c002a5-964d-246f-9902-8c575a37453a
  5 c2704339-669d-7669-b17f-f1d8bf4bb672
  6 5db565d6-4118-00cd-9b49-77583f8e7027
  7 921d0fb7-1565-76d6-828f-0499798c7221
  8 6a28f709-cf75-2177-8b04-85bce3aaf81c
  9 c42c1c40-e978-5e68-b44b-aa4a001f9083
 10 16ce3901-7f72-20be-a931-b7c92eca6c35
 11 089bc379-dae2-65e9-b53c-eef1c9067a6e
 12 3e80b148-2a57-1398-b206-d50ed99aceba
 13 fae49ad5-40d4-4d55-a0e5-24cd12f8cf2f
 14 8ddbb04f-29fe-72d2-acce-cdb0f9bcc17f
 15 0ae3d09c-2844-58a8-bd3d-bb9079b5e72d
 16 a2de4565-5f7c-7259-9433-fd22253e4e46
 17 c82e3f99-37ae-13cf-b4fd-4c3019ecacda

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 68627072526147571. Exactly this sequence comes out of new Random(781).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 247 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related