201210031401 10vxat

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 556

Metadata

Post ID: 10vxat
Title: 201210031401 → 2012-10-03 14:01 on A858's clock
Posted (UTC): 2012-10-03 18:01:25
Timezone: UTC−4 · title 14:01 against posted 18:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210031401) = b8777e1d8b0ff46495d6db49487e323d (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(556).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 102 · predicted N = 13 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5E755680D725CBF4 CE96A0A7D46E1C19 59980089C9D2DCA4 C2B987AC487CEF5C DCB2813627201E2B 5E44CF95D0A45F66 152C697CE65F06A0 3481282825FBD213 C35383E0FAC3DB3B 8AD0036B2E817EFF 1880F48BD9C1C408 DF7F0C402B27E7EB 91F185E4DA8EF90D 05BFF5EC7B645255 768CCAFD6AF763EB EF1A637CB11B6FBC 5360F331E65FA450 32E61639D48B1854 7426AC5889153AE7 EB6706B4B676C0C7 9F5186AF72D4C331 94F0EB7BF84DCFD3 67F6FC0C277A1868 4571FBD65F316ED3 F1AEDAFD7454A4B5 A3CFD5934BFD1625 38DF28D43E83754F 3F41F5D458175062 49F72A0868A27759 C404027E6BDA5F3C 8CF14E09B49AB675 2FC754B9F2044600 67C685C79601DBE0 0EC09AE0299699BD 07266791ED41804C DCFD9254AC0E06A7 6D478C2C74A7AF67 137EAE9822704E06 05B9BB42F40C0F93 C6D1D71BC8A4494B 5D79AB0DE755A41C 871A09D554B875DC 2DFD007C45B279D7 5ED0557ADD3040BE A5BC675F1D7C9235 F908F96E0E1181D8 2A491CAD955348E7 6177898614D85F0B EF95A1057D54FF6D 47BA186027A4E2F0 95CC2A8B1A951DEF 18C950DE2F0DFB53 F209A08DD70AA045

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210031401 (name+title). Key = MD5(password) = b8777e1d8b0ff46495d6db49487e323d, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ee9d470b-843a-1fa7-b88d-73320c9a3e3e
  2 c8a32d68-9aa2-8e9f-8f78-e5bbed2bc63e
  3 a681045b-2372-3db2-b69d-5b08b6e6fddf
  4 aec43d08-c4a5-26a6-aaf4-c3d92ae36d83
  5 cd0c207e-d284-2a76-b022-38efe3e132df
  6 276fb5fc-f064-44c7-9187-09f45f286ddf
  7 fafc6c39-36f0-0e5c-82e4-14c6677f9bc4
  8 e774ddaa-bb68-340a-914d-a868c40bf85b
  9 eefb407b-41f3-65d6-ab7f-20b743ce9a81
 10 21a70679-bbee-245a-892c-a37ef01fbdb7
 11 7720c047-f79f-8032-8089-9b7ec270dbd3
 12 785e5122-d176-4075-9aad-9569d0776bf7
 13 1c9d6432-b5ee-7dcb-8088-5470eff274d3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1832240362847. Exactly this sequence comes out of new Random(556).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 102 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related