201210021440 10tvct

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 983

Metadata

Post ID: 10tvct
Title: 201210021440 → 2012-10-02 14:40 on A858's clock
Posted (UTC): 2012-10-02 18:40:25
Timezone: UTC−4 · title 14:40 against posted 18:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210021440) = cd207a582b799fff6de27b562ccb8450 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(983).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 32 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8724038B4B1A8B9E C76291EF80EFE945 6D0093C8F3196AE8 EFFA8A1221C46B3E A45B64457B4FB583 33E87B3BEABA0F29 251EC908F26BB66A 185EF858E7B7EA69 7B08B059455E86BC 359CDA4950332ABF 385BA590A22C3D19 2B9ADE906FA9FFB5 24CD11E93D710CC4 B359AAA5F4B3298A 89A9385A16E4C885 D9DC4A1EF87013EB B83D063D391FAD34 45D3220006567449 6204E02551955F68 568D838A90291148 33D2BBF9F93AFAA6 7E230D122ACE04EE 409EB8CC32EBE10D A33817BBDA306F39 2E91B3CE3C92BFFF BA954412923F6D1A C8D1596407E2700D 054BE0B7E78BAAA7 3EB133FD324BD4F7 9587BBF028688925 858915650CF3EC89 2E95C5F76D3B9BBA 570C54193FACF36B C6E9A465A0019B16 F280354EA4723305 D7EAB512155EC80E 662A93BBD51EEE41 0D9AAF672B017884 C9AFC4A64E61E555 62B1E5029E3425AB E495E0CD35AB0E6B E3F6D74683A8F76E 789AF69E0C98B07C 2C5DE625B0FACC26 A60A6F5EDFF0D50F 67EFD272AA2D1CF5 A76638DDD70B1705 ED4B167D1945435A 5BC43B68516A2652 6AC5DFF3423D72F2 E91B793757B9CDCB AC0292D8E624C11A D0713F82D7580226 DB9E6FF38CF60853 16C9961780AB695D 5BF4C367134B33D3 A36FFCD54D11D749 B0A0A56BECA78092 66785606CC82A810 A943B44732133F7F 7A25EC6F57779F41 BEE8481C2C9B0A52 E5A640901C924462 A23062098636901A 8250377E0CEEDB63 F47C04984A537DD4 BF822834B044E65F 5F4AA06C99BA1B90 67FB42C2A6E64591

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210021440 (name+title). Key = MD5(password) = cd207a582b799fff6de27b562ccb8450, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2d64e878-10a1-2a96-bbf3-fe574a9c8159
  2 6ddccbd7-afae-2da3-a98e-573d94c45b59
  3 f86695fc-2bfc-7968-8ff4-9f9b2deb8143
  4 d87059d8-5b09-39b1-af87-fa0f01883c1e
  5 e594d486-85de-01e2-88e9-275b924696ca
  6 24625b05-91dd-5e97-b9a5-029f931dceb2
  7 dd8b9886-02b8-367b-a93f-18c102483653
  8 14d0a2a1-e80f-5428-a0e4-50016c34fc0f
  9 48de44b8-87f6-53b2-b9ab-cd34cb011238
 10 3d6429d7-1328-664b-9a85-daac10c276b2
 11 b02c7344-51dc-4b79-b1c9-2b4429f466a0
 12 36b2c00d-5f52-8daf-9e8f-1f7ba1b04d12
 13 a8f18a1a-890d-3bb9-9b44-79932d4aceac
 14 4ed66f1a-9273-7ac0-830a-317d3589c743
 15 3618f57d-ebf1-0dea-99c1-ba62c3e656dd
 16 2386d141-5361-89f9-a935-1d5a400b302b
 17 f9c75e9b-de2c-0b47-b3d1-9c5c39c402c2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 22730535564837080. Exactly this sequence comes out of new Random(983).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 32 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related