201210041942 10yqtq

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 880

Metadata

Post ID: 10yqtq
Title: 201210041942 → 2012-10-04 19:42 on A858's clock
Posted (UTC): 2012-10-04 23:42:42
Timezone: UTC−4 · title 19:42 against posted 23:42 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210041942) = f0c23ce5f033a1847f031d8d12292fe1 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(880).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 191 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8A839074932D1E56 8F75B99493420F43 CBFB3CC3A955F9EA 1DD5C6F9AEB3963D A1AC8768DEF2C0B1 7D572B0C73B27484 74960DCF15E2B49F 25296B2907DFC80B DB59618886BDE0BA 61247423347C9A50 BB1575F0BF45D7B6 7807A688C936BE69 38F3257E179782E2 602EDA982875772C 90A78DD7363260F6 1BC30D6C32E5936F DCA385D6A79D036C E13981ED627DDEF7 6517C3F6FD60E598 95EA7120ED073B89 7937AADD90D1187C FF4E656BBA60F326 C4EE5A1A6878B41B 61847BD59305BC67 7B95E939F0EBF61F 3F2957DCA7F23900 2F007713C1C4E3C5 D9A1743AED756410 164BB406EA768934 6E741EABA43CB107 61B5C48D3A38D718 F61BD96D5C5B83B7 0DB12965E917D3B9 1D65852F16F82FF0 00E7F48746FB0166 DEB04E417471259F F5E0DB6502DC01D5 2A85569DEBB946A7 A59792318F078F96 80184A6958097C8C 325E3605B34136AC A061A05E0A3189D7 33023F61FA04E83A AD868AFBB070854C 7D047ED0833B68BE 0026917FFE973629 050AC31895C32C15 5A2783C5B8FA8482 447497AB05E9645E 3C66FC16928A5886 C0598389492122FE A140C8B17DE1FAEF 235A55846C662B6C 39E4ED13B23E6CBD 69342BEFE3DC5AE5 6993646B89DE378F 9037C9C0F631BFA4 BACF79EB31F2E00E AE7ADC23916C1DE9 977EEECD5889D6D2 2D23A93583162490

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210041942 (name+title). Key = MD5(password) = f0c23ce5f033a1847f031d8d12292fe1, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 44dc3c06-ce13-492e-8396-321b499c4042
  2 3d2d8767-4dba-0dbd-827b-dd03b9df892a
  3 4ab4e669-8cec-7205-92f7-fd3f0c2f9cb6
  4 44f3a606-9b98-3755-abdf-2a7e4974a1c1
  5 be3d182e-1f12-4533-ade4-a29d266ccdb8
  6 5a072f50-e460-5ab1-b188-75d5513948ab
  7 838ba0af-de22-1b77-a6ed-f98d3031dbb1
  8 427b30a9-fb53-8b01-9cda-573922a0c08c
  9 021c2dad-5352-7659-a2ba-be541cc0cb35
 10 dfa83e3b-fd3a-6a20-920d-7045c139da21
 11 c9dbe9c1-9361-5091-baa1-5eb1d0a0e755
 12 c342c757-a64e-400e-abfc-4ab172fa5497
 13 e6c737c5-4076-5d99-8f3f-487c9ce5ede0
 14 d72b0ccc-487e-242f-92e1-8b3d891030b9
 15 e40ab3f0-9b50-8ed9-871d-1d4c7e1a2b8c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 407345187654528. Exactly this sequence comes out of new Random(880).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 191 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related