201210050443 10zgos

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 766

Metadata

Post ID: 10zgos
Title: 201210050443 → 2012-10-05 04:43 on A858's clock
Posted (UTC): 2012-10-05 08:43:02
Timezone: UTC−4 · title 04:43 against posted 08:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050443) = 55c52df2997f4b710363e1ee9ee84431 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(766).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 218 · predicted N = 13 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

01BFBF862E1D910F 6B7DE6E3803146BC 058D224D754D2743 5A86DF8D6E542DE4 96E0F6D20F6A1014 BC417E7BA7CCCB2A 1272AC12169668CE 990E37C0D3A417F1 3397C13C54346118 13ACBCD42DC66B66 286CA982F03D7698 348DBC717F342204 01743F592F7322AC 68EC902940C91962 8F29479B219410FE A7817B235E9D2E0E 55AF59CA2D435F02 E6A1F984199E5F94 EBDF12A833DD6F08 B12A03C7EC481FF0 4357E55E84BB4BDA 96781ACEF275BC30 BAF38657B5149742 B0DFD76CA2D5F6CB D831E1FB286E9A51 1662BA3D88BAD4DA B033968EBCF8D5B3 2EC992CD0C446D14 E447A17A04F852F8 2C4DF04FB05A72CB 291DAAA0199E81E0 1BC9E5BF57711BC3 9554C7A740381F10 BFFA0A542A67D019 2C1E739FD54EBEED 06FB06F00681E57C 363E32D8588DBB73 F83C0EF78F5DFE20 EE76C6F96B372B58 6B159744D4DEF5E4 ABB8040C291B5CF1 62BA11CB5A6BE61C 4595723FD6A0A378 6D465AEB161E9244 2CD3105D3D1147A8 D0C0C72B91166496 377AD8707A211F3C 4F1C10DE3C6A23C4 078BF9BCD5B1DF66 6F3ACB760309CE70 46E8049AD68FF918 0E1E67AB358109B0 1560A072F22DE805

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050443 (name+title). Key = MD5(password) = 55c52df2997f4b710363e1ee9ee84431, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 266a5578-4263-8791-a7af-4604a32cbcfd
  2 79e491ca-646f-5bac-9077-5b9c29727bf4
  3 906f8617-4607-16d0-a4e6-f4faae2bc33b
  4 dd266540-58ba-0f83-a7d3-864a6c8be784
  5 b943e370-3082-0c29-8766-606dc999b041
  6 5b0ea6ef-c2c3-80cb-8a5e-7ec008cbe6d6
  7 8ec1b47a-663b-1d4c-bd50-d0ec4ad25225
  8 de70c95d-fe0c-6eb5-9cbe-8440581b4709
  9 a297ec53-c77a-6da8-80fe-1125f64de815
 10 979cab36-f66e-6f51-8039-54a0cf26b73c
 11 53dfea48-1172-5b36-a58b-a441b2933fc1
 12 f1b302bd-bfe0-471f-9c8a-7a7d025c1b21
 13 ac814a44-341b-18cd-a993-8563b5b18b61

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8510081666541. Exactly this sequence comes out of new Random(766).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 218 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related