201209241424 10ejw6

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 481

Metadata

Post ID: 10ejw6
Title: 201209241424 → 2012-09-24 14:24 on A858's clock
Posted (UTC): 2012-09-24 18:24:21
Timezone: UTC−4 · title 14:24 against posted 18:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241424) = c1c5a53844b7fe94d4df70d9b44f39cf (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(481).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 249 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B005A88B98B4D121 859146BEE5A43B17 B7322C2F7E624E4C AD03B77EC1AEBAE8 92686D5DA16C2320 194EF922F6B55E3D 8C4716983198D800 717958D7F9A81928 47AFCF318541A99B 229E6D48A3366350 90B3CAEEB0BD21F0 6BCE9E70D841E8C2 40D04A91E93BEEBB 9471BFC55058CCAC F0DC3C940B7C40DE C094F526C50BACD2 E35506A3745F3839 9A997E8033F9762D 317D54F988A731E4 BE23A6103A726B09 C22742AB64AE5293 FC1EDB488FA8A4F9 A821218C5A65EA94 2661024306D2AF95 24C48131AF80CCE0 C20A0A37D5DAD59C 48F89656067B19BF 21E5F150C070EB81 4A0300EFFB64823D 5C4475D27BFAC789 F31BBE62DB821730 A182FBF1129D7F50 814C9B008A093C3E 4B5162FF42BA483E 0F1FC7223CA4BB71 A5626CD602C2A08B BAE3D5DCBA334551 797C6CD7DBD30F2B 2E87026ED5A5E42A AE32FFD3C753C965 42CA83C369F5437F 50E1DD41CA176B43 970EA745FE08DB3A 3678D9500DAE7860 3E7879E322E66214 969C96E552189113 8794A0F49C817656 59586B399DDA9FE1 BB43D0BA4923CCA7 85D694BEA4037589 E709F689F3FA0F2A 2C3640C452097651 A2342100A7565360 FF55A09BCCFED45B AF2FCB0430DF64C8 8D070933E18722B7 711DBBDF9F029B5F 54A0EE51D8005EDA 821BCCE6883C2ADB 8E5CF7E79591DC07 36B8354A88C593F8

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241424 (name+title). Key = MD5(password) = c1c5a53844b7fe94d4df70d9b44f39cf, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2ab86a09-d9f1-0121-9153-5822e036f5cd
  2 6e7252da-9120-8f68-a30b-7a71814c3ea0
  3 38ed03a4-9e10-8ce0-a7e3-62c480dd05ba
  4 0de10caf-fdd6-2d01-8e99-8be5109f78fe
  5 f36a88cf-e244-3e92-9107-15ed5fec76fa
  6 b2a8421b-2d3f-8f86-881a-605d7a2bb60b
  7 d197a55e-722a-32fe-bdd3-5f624b8da58c
  8 d1b5dc4a-a60b-6b5d-a7d8-0059e61623ec
  9 fc8a6e66-004a-4cf9-a3ac-e5824ba89063
 10 37bb2a6c-3dd3-5e3d-b2c4-d30812bde2b2
 11 2e97de70-a149-5d5a-b455-5761bb5a210b
 12 fd80b59e-4089-8d78-b981-fcacc9b34ffd
 13 737244e8-80c8-2baa-96e8-cf17719475b3
 14 cf41e27b-ca17-63e1-b647-b762961d8147
 15 78e43fbb-66e4-6346-8f42-7229a030f3f2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 088238364558266. Exactly this sequence comes out of new Random(481).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 249 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related