201209241432 10ekf2

explained decrypted filler

3DES(name+title) ECB, 16 GUIDs, seed 147

Metadata

Post ID: 10ekf2
Title: 201209241432 → 2012-09-24 14:32 on A858's clock
Posted (UTC): 2012-09-24 18:32:33
Timezone: UTC−4 · title 14:32 against posted 18:32 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241432) = 3a471b52f2526f5540e0ff447653fdab (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(147).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 257 · predicted N = 16 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

61F28E0339BBC666 1A7225B9C2B9BAF1 2339C7CD40BD9263 38B2B01E24A30CBB D1327A30C9887D20 9486763732DF78AB 6FD70D7FB7ED9ED6 832A81F696D3C060 44E75156E61E819B 9B416A9A344C690A 7397A88961C8AE7D E9CD2219EC7D7DD4 15BD7C757DDE2CBB E57D0D05D718E938 F198E00C31F928E5 D03CFB4946253A2C F12A8DB844EE7ABE 109250BA64E3DCCC AAA6766326E2EECC 47C24DE8F91EEFCA D2D74972A3687D9F 5247C4160B12FAF8 FD83FDA202AC15A6 2A99C8BDD8AF6D8C B517A9C2D6DEB8C9 0767F3B3A6C7B9B9 1422CACF0A4519A5 9EB7CC57C80F4F09 5BA4A471BBC3A2E5 DAB423661A9B0136 8371275AA4A545D8 76509383236B4796 86D7EB1A6308E4D8 D9C0E59118EDB97C DA548261FE2A361D 5BD8905A72EFB55B F43305BE4A956ED2 FC1E5802F6E7ACEB 95A8158FDB821FB2 56A749EF20CB65E4 3B277DC6DA83F373 DF972D3633C02FF2 482930C14D47DDDC DDF6023A2225C4B9 5D6B1EF70DE1BF2B 44BE07FC66503572 2D90CFF3A7C55802 093DF217931384F2 97299D6A09A77BD6 93F927721A122B8E 77337FE09EADE71F B337E07C7B2B0295 8207E43E8B1696DF 58FD0998FACFC9FA 0C6CD7E36CCF0703 831868E6827EFC17 FBDB14EACC7C9514 24C685FA15919F13 CCEAD6BF6C7FF8D3 6B9B7A3F9755F8EC 777E1211DB738757 908F11B96630B923 302C0018C10AC5BA 44B933A5D4F216B6 94FA4CDC54C71D24

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241432 (name+title). Key = MD5(password) = 3a471b52f2526f5540e0ff447653fdab, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7f214dce-7958-4d85-ba62-dde2fc406c39
  2 d456e367-ceef-89a1-9c9e-723243f819e4
  3 c2648671-2b96-4fa5-827e-9c80e7d75214
  4 a89746c7-383d-807c-906c-9bf3e0c900ae
  5 76df9e29-04d6-5c06-827d-7b1479595089
  6 cc9874e3-7209-07a9-bfb2-afd3f5f50ddf
  7 7f245883-56fb-6ea7-bebd-5884373dc0c4
  8 d7e54c0d-4456-13ca-8953-056d9dce0031
  9 9297368f-a685-1c43-8777-576aa020a417
 10 a0581833-b884-4afa-973e-48009205e675
 11 094eca8b-3870-58ba-857c-73c3181dde77
 12 8bd44d8a-f34f-271b-84e8-58086ee91b8f
 13 c2e92086-6dc4-6682-bfd8-b062186a2ac9
 14 4a52f1e6-4d6d-8cd8-b6d6-2011e6c239d7
 15 d9fbe9f4-7403-748e-ac50-0bdacd29ad31
 16 419b6950-101e-7022-bf13-9c89225589f1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4848506114526877. Exactly this sequence comes out of new Random(147).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 257 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related