201210031741 10wcot

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 711

Metadata

Post ID: 10wcot
Title: 201210031741 → 2012-10-03 17:41 on A858's clock
Posted (UTC): 2012-10-03 21:41:32
Timezone: UTC−4 · title 17:41 against posted 21:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210031741) = 3bcd7c2907b9e687046c78c4a8a9ff38 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(711).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 113 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D68962020A1E1823 AF23C641D0038051 2A4004E86822C461 DE5777680F1FA03A 643107B5399FBA8D 5D182C9A6B3086F2 5C267A62160D9A2D 15A2345749FC6756 FF40E1DC9AA7D716 90C1499752E9651D 5FF0E96CD498DA1A 64E99A5006E58D7F E8E70690526AFF18 F1CFECC8E01E17BF 3FE1E942DE067D41 746B844BEFA233C4 EB7CF01EC6D861E3 495FA073D15C6A1A BA97CAF060154F50 B313AD2FD04CC842 1816D80F7325BD00 6D92B1EEEA28DA99 587F999A81F32BFA 7D4BE3C883873E20 B6BAB501AB9986F5 058B0987BFCE8B84 9A79E2C2AF479F3A 64DF1810A54A4374 A4408A983F65B305 2B286B28DB59F337 6EC435329187A60B AFFDA392F2559E45 24711D4D8D4FFA79 0D15842185FC0EEB 78047CA7D4936177 F9A51A0258640748 CD705FC2A6747417 A9E024729AA56EA7 70E05D0EB2317880 347316DDD151F646 137247357A8EB96D 77F1870878E47FBB 407B56F67739D731 3B175F834815EC59 AEC1308D3E8B1B7C 7F2E328168889C8F 75C3C0D48AF0C1D8 CA8FB6F52E6E4ACB 14F766783BA2F32B A93E417C99A883BF 0745B3289EED23B0 374599759F7277D3 742FD3705EB16038 7932645ED2E13EB8 8C390C04CFEF6DCE 640B51633E033D97 9135CA3AE2DF8DEF 44BD3C32914956AA 5DAC19DA296716FB EBD29C3C2DD4F2C6 81E0C73CB89741DD

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210031741 (name+title). Key = MD5(password) = 3bcd7c2907b9e687046c78c4a8a9ff38, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 057475b8-034f-1e7c-9107-2d4014759da1
  2 3504b178-f952-3dd2-81c5-ade56e5d04a8
  3 2d534a96-70de-6002-be4b-3ad55eec6570
  4 63550fb7-3fd5-2842-a2c1-24be9138502f
  5 1d35d6a5-1b1d-178f-be33-309dc3d65c56
  6 156b95b9-d983-886c-94c4-0d05ffc84416
  7 52f48ac4-742a-48a2-b651-2cffad89fc0e
  8 932148eb-86a9-1c6e-9710-c47910dd0aba
  9 a340e2f9-d989-8325-9152-c8e6252b0614
 10 075b1af3-5d35-4c0f-ba33-35b82a2f2e4a
 11 7db7a606-d7d3-0fcb-8e41-d659eea84d2d
 12 a42d1de4-9047-448f-a2ed-3ccbc181c43f
 13 6617b6b0-0fc7-3c8c-ad07-db9962c36977
 14 bf82a09a-49d0-3f68-b7de-f1ac1260166c
 15 004d331c-ff74-5287-a28f-366b1e7de352

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 136218418404335. Exactly this sequence comes out of new Random(711).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 113 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related