201210050302 10zdzp

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 744

Metadata

Post ID: 10zdzp
Title: 201210050302 → 2012-10-05 03:02 on A858's clock
Posted (UTC): 2012-10-05 07:02:58
Timezone: UTC−4 · title 03:02 against posted 07:02 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050302) = 9d3b48dcc44c1595911ac706a3f03b0a (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(744).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 213 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9DBB32330DE7E2BE 07E1D94E89B0F9D4 596267E6189FF4D4 84392C9CBFA5CF43 520363997BBC9B70 41E4029509AFA34D 8C76FA3A0295A923 B7DA038F18737783 190F3E6AD4EB0497 61F9DC7C1DDD0F67 21927C5F47F95C7C 6CB987D272485B96 6C5F1A0B3869C6C3 67DC9AB0C743B4EA 4617817F737A3E95 DF040D0F836EAF47 8C51EAD996BEF1B5 D8D53F184C4671E8 9C9190ED9D440EFA F73AC638B5A0CC9C CE7F377917BC9657 C151FD66DF8EB59C 7389778A01FE7612 B1278D8ADBDEBAB3 813E48BD06170BB7 D33DA987DEAF3207 8872E3B2FF559C16 F9443F3611F6450D 0B6DDC6F4F036889 38DC1C7CADF5A240 13422BAE364798C3 7F565B572907AC6C 2641E84E3E5376E6 F0B3A4E9006CD2A5 E72BBE22FE21F72F 16271CA91C764397 3A4E2D9F45AAE937 2051004376119E93 120BBA9C72EEF17D 6EFAE6DF5037D8F8 E1186D0F6872253B BF0192868C15ED37 4FBBDC11369A77C6 EE5D120F122D6BF1 ED63EA9C6D192428 A3820091328A216A 51D358DA8E2151E7 5D55A37914C677CF C615646E00769934 983226AEE2546E38 682FBCE1A053AB85 B8DAB25E424523CD 841EFE33453AF7CC DD5E0A52E4DB1039 F882A8B98B8CD331 61B570AA93BC900B 5A8302E7D9A865B8 2FBDE0E000AF8786 6025F5B626BCAA21 8DBB8FD7A428F83D E87B3D1B6ABCF47C F39E2421CAEA7426 A2FF81FD6B06C561 C05A7152CA33B73D ACB4274DF64D68F8 B74034D6052FEF52 AA781494E513119F F7AFE9E11F1B3841 393C5E6D914CF4D6

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050302 (name+title). Key = MD5(password) = 9d3b48dcc44c1595911ac706a3f03b0a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b6b42840-7bd1-3e70-b5b1-eea93a997abe
  2 a14fabc2-e5d7-1219-89b5-8d7e54df2658
  3 de4367c2-c7de-7896-8a57-55443873cc6b
  4 afab863b-212a-3e66-923a-2453ed117017
  5 248daeb4-3f0a-183f-ac0d-edec8f2fc766
  6 980c25d8-6dd8-62a7-8754-08929923bf2d
  7 11ca6fa6-7c75-22b1-8ff5-684840b41366
  8 deb8402d-407a-6f3c-ac18-f9ec0a4cb689
  9 9446bdd3-1b39-080f-a8db-564793dbf0d7
 10 81a1a184-894c-5e5a-bf35-39e8f7269aec
 11 7ee11270-e1d4-3a6f-a5e0-c0e0cc78e9fa
 12 ba99c0cd-d118-2673-b0d9-5752f67d50f7
 13 865ee8c6-8668-0f31-9971-30d4f4966090
 14 804e7de1-33d6-408f-97f4-b462dc572e26
 15 5b927736-2039-6be2-90f1-cfab04e46aa5
 16 8d66b0ab-5d33-68ad-bd7c-79678f9e65d1
 17 0a768103-7504-585c-80e9-a661a93f8868

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 31731626053204665. Exactly this sequence comes out of new Random(744).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 213 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related