201210040742 10xj3x

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 943

Metadata

Post ID: 10xj3x
Title: 201210040742 → 2012-10-04 07:42 on A858's clock
Posted (UTC): 2012-10-04 11:42:09
Timezone: UTC−4 · title 07:42 against posted 11:42 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210040742) = 60b6b5c459516012bcbac884878bf527 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(943).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 155 · predicted N = 14 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

0358E3FBB8D30D07 6E59B92A0CA0470D B8A630468B066278 D757B428DC77B2DC EE8A585208F55E7D ECE21E1AF710CEE9 C835184A398F4ECD D762E0C94CCCFF1C 7E05A43B1C9E5A1A 9C071922D84B4FDD 8F348EB7DACBA81A 3624615FBC4F6FD0 E02393EB22FBF4D2 898040001D5C92D8 A19E35D88C11DC00 686608C5EF4DE27B 166647D4957CA8BB C9CED7D87ADAAD22 B86CF20228D50FBC EEF92DA0E0576A3B 64BB591DECED281B 7FDDCD7EB964E689 1B044099B6F6516C C9BB8FB685FEE4D6 3382B9C1035F2C82 85BD715C40617040 F86098F7B1DF2F2A 6BB3D0200527F83A DF9D0B52DFBEE2AE 4865A5DE794B2FCC 7A42E4BA6DA2769E AC8BE575433004A6 AFB9B6410B1B1E41 3B563609F45A1562 FDFA14090C4B95BD 0D771D8C99E53FD2 249605797C0C318F 12203DD9E69C84A1 1B89D90F996CD869 69031220FD11F254 86E7157516EC9586 E68FC1376BC96800 4EA75C5E21014FA5 76115B80CC0A3012 5EFD7CA43A80E416 3E9D77205B0595BF EFB47D40F95B6099 106D6DF263939072 4B45A416EB48647D 08BF57A41002411B 77973666208C7FB7 A29C6F9BBD74E185 094A60910FEB4DE7 A28F473CF5F12235 4329E12C8DF6DF5A 3B35FBFD6B975524 3C095F1972E97B4A

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210040742 (name+title). Key = MD5(password) = 60b6b5c459516012bcbac884878bf527, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e9ddc8df-d7fe-3f0c-ad40-efca16b04b1f
  2 d0036619-eadd-4ead-bbdc-dfeaa66e2f3f
  3 34d3e648-11d5-8b51-8e6e-b21191a6a627
  4 fc0c7698-30cd-73ec-bd81-f73ad6595591
  5 6c6db756-b96b-83b9-bd67-49a28f3c22b6
  6 fc11e396-fa5b-5b14-84c6-b4388d06c192
  7 6eb37631-b827-3ff7-ba90-32ce7a7b1591
  8 b9225338-1f0b-48fd-ae56-f79b8b3797c4
  9 3acae257-0f1d-5433-99d2-2d93d6bd4bf1
 10 c4ccd4f0-cae7-0219-a98d-f7fb00a53b84
 11 c31c6802-8bf1-01b2-8f25-34afea35226e
 12 136aad15-5b9f-6aaf-ad42-9929e884b787
 13 b2471865-016b-8184-8eee-92e1ec883191
 14 7f93074f-8d90-030b-b09e-394c050e8035

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 34878534500680. Exactly this sequence comes out of new Random(943).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 155 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related