201210040321 10xccc

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 67

Metadata

Post ID: 10xccc
Title: 201210040321 → 2012-10-04 03:21 on A858's clock
Posted (UTC): 2012-10-04 07:21:55
Timezone: UTC−4 · title 03:21 against posted 07:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210040321) = 3feb202da028250961eafe179faa695a (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(67).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 142 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

62A0D21585F0F8DE 19029BD18579AE9D 370517BA057E1C4D 617512198D130E04 B10E23C8A7301CAE C8A5AB43B249B3C2 3B7BCB1C3B4C0B8B 24F5C33AFB5F74B3 5C9DB13823BC7BB5 98645166308DBBC8 53B3FA541AB638F7 023CF27C158E4170 49BB4705A0141B1B B27D9759710C2B9D BF3162FB047E6740 AD24C063F04917DE C9CC50288738828B A26F9F14F6AB91D4 801D52556BF4A399 A3438E8CFEC95529 0563CA0F573D71C4 526DFA97EB6E7E38 E8002526BD447FDD F41DFA9395720D48 D05DA8D59B13BC50 6542F9391EC84394 9632A06582BAAC91 8A6035CAC17C3CCA E13D6E4C7464F3AA 07A4F564C77652E8 C4812E6DED02B49B 54BE936762897C46 280C93B1D3379BEF E404CEE8B367F308 CE30675BD58318F8 44FD0880A220BC8E A5CDCE818B711E0E 3536E32CF252044C 44FFD27321CB4ECF 2CE911C0ACC71E63 29321823E8998651 3C28F1DED2D4B970 8936DF081C83A1DD 0B6F724DF7DE8DF8 5DB3F570FDE9BC7D 5153967C65290A8A 26758CB0D786C138 7AE0507BE160619D 52807C21E8E54E2C F56FA159AA0AC9A8 A0F20BEDA0FBA7FC 6225F5E1562E1D3A C62A56936F96938D 436E53B3594226D1 2AA7E32D97BE5C4A 7B0385BEE9E774DF 7C6FBA4655799D7B 8C7F4FC6274E2566 09BE8E41F77671BE F36BD7600A93D2ED A29F31F904FCC2C9 03A997231183A644 D40542E3B71DD76A 138BB5DFCB744726 38A1268F1F881D07 74274FAFC2C04401 2FAD2E18D210DC66 0537AB93457856B7 C3E4ACA7F6FB1966 7BC0687C0AD81026 B8DE64F15570EFCA 560B68C164D7EFBE BE686C4F8E5387CA

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210040321 (name+title). Key = MD5(password) = 3feb202da028250961eafe179faa695a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ccdafedb-63fb-66d8-b203-42dc0f046d1b
  2 2ac17719-a3b5-44c7-95f2-36fca6458841
  3 9edf50d9-25eb-526b-a1b6-ee152d6f5928
  4 0c97570f-2808-75b2-955c-dade102507b1
  5 fc563339-e75a-4bed-a415-447a7eab82e9
  6 da6307b1-1d49-08d8-8512-590611f540ab
  7 553174bd-f556-80d6-a953-b5465ac4f7c5
  8 78b68cb8-6f5e-0a2a-80aa-196e76780c43
  9 5308003b-f2d7-29a6-b845-c502846a6146
 10 f85c86bd-d2fd-8f29-b14b-2334473b735d
 11 17b31b58-4dc7-5788-b994-02712bc24cbd
 12 60df1d97-3994-6d8d-b588-f18c162fe8da
 13 db2f8e5a-014b-65f8-912e-cabf704c4528
 14 6bfc068a-0e7f-2260-bf85-379229d52ec5
 15 4fa21d93-735d-7bf9-a367-1486d1c37f47
 16 b1e0b97b-2c19-7e78-8e66-295067cfdc3f
 17 1a562a96-869b-0e10-8147-249390909e57
 18 685f0ecb-7b43-4e82-abbb-3d0aec5d7411

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 645740802856627704. Exactly this sequence comes out of new Random(67).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 142 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related