201210032341 10x1pd

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 228

Metadata

Post ID: 10x1pd
Title: 201210032341 → 2012-10-03 23:41 on A858's clock
Posted (UTC): 2012-10-04 03:41:48
Timezone: UTC−4 · title 23:41 against posted 03:41 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210032341) = dd9aad13c007123f0bbd05d1046ec262 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(228).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 131 · predicted N = 13 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

039F592398FDF098 0F669102129C3AE8 70BE9B5342FB0003 D4E59DE84F4C7C31 43A9317A0D28B9B7 C04E1AEDCE3156A3 803ED95A6E0DCD12 BBACB1897EAF929F 6758C7AC3B2204D8 C7F6841608B58C64 A96E50D720F341B9 DE0B200361C67D1F 1A4D77D190393D48 0A79516A2F0866F4 0A85491F6A447ACE 63530C22624B2DFE BA59EB47F0431F7A 59688915A55B52DB C04C9D29A355E233 34CEB57FEA0EA8BE 1F6663D1B1C51A5F 1961F538519ED89E A24ADE5C914CD407 9A3B21F7F7661D1C 4DA8A25A07FC625B 4A4D7A8155CD7C42 8BA88D554A473D0B A9A22A28E38C8580 CFCBCB93245363F6 D269DE35F04F2501 98884C14CFFAC0CF 6F0CA34C4F8A0B44 4F55BA0960CA38B9 95B45070A4BF0842 E3FC5D51F71784D2 BFABD3382499A765 2EC45957197DB6D7 B65F4F2FBCC2F0AD BD786461C81BDDF7 49FC3009BC570664 83CDA20B64A1E1EE 17412086371E5059 27C4C358AC95A2E7 4A6B399183733065 AAFAF0597EC03C22 E5B65356194B6C08 4642323377C2DB9F E23822DEEBC38612 8E39741D61A91EB3 DB923D83AF506812 52DBF3D117EDD260 09F1893220E53E25 32D966EFFE8DFEA8

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210032341 (name+title). Key = MD5(password) = dd9aad13c007123f0bbd05d1046ec262, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 903f6eeb-0f59-70a5-b0a9-d091406472a1
  2 3d1a641d-5809-6518-b133-610939ea3ace
  3 dc200dea-d259-1ca4-b3a8-dd4eb955fa8e
  4 b42270e9-27d7-236b-9040-71309c909bbe
  5 72c6812c-f606-126d-a6f8-74af90735d95
  6 64fc2344-5166-720a-b477-0c89a324e19e
  7 bb4721a6-53b7-0191-9c68-2b2965c687db
  8 439770c1-8330-7985-84b9-be788b587ead
  9 9fbb30fe-7f8a-1979-a94c-7c1198870f05
 10 bb787ec2-ec0f-3d33-a32d-8933f062553c
 11 59ccd381-13fc-27c7-a942-158b2e9ef867
 12 f74fde06-02ab-4216-b420-e0a7f57b3172
 13 462ee999-2365-38e3-843c-2308b4fbbbc8

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7612170713243. Exactly this sequence comes out of new Random(228).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 131 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related