201210050523 10zhly

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 718

Metadata

Post ID: 10zhly
Title: 201210050523 → 2012-10-05 05:23 on A858's clock
Posted (UTC): 2012-10-05 09:23:04
Timezone: UTC−4 · title 05:23 against posted 09:23 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050523) = 15fd87e891fbdeef9a255294590ed85e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(718).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 220 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

BF6255F1BA2C50A9 CBCA506E9F2EB90D E1CAB71780C59A07 C8B8F52FF66B1DF5 36104325E288677B F139C6677A23B5D6 57784383675B5344 557EE3E501266B72 473080A09329107D D8F26C0DD8A27E1E 0591365CE068D937 4967A0616A5C6F00 30241EBAAC561C18 F046331BDFAD4C36 EC215C26488E40E1 31A74FA3F84C59C7 7227C98D213111A1 619ED47BD948437F E6C1A7083FCE23B8 EBF785360DCC4286 AE35B49CA81C77D1 6BFE25A0F2C45CA2 73126DD4E5955D5D 54305BAA9A956117 AC9AE283236CE829 4F1C12C527E3E26B 7CE35D9D0B9BED80 C81607C4E8F9ED4B DE2E3AFCD03A63CA 9A5F463ADC1C0C5D 396887D729E2DC7E B1F09CFF841BCE45 0826B7DB9C6BA80E 5EDF29CC6F16583C 628FD054DBD541A1 714FE7ACD4EC4937 C2F23B12C1336950 BDC8446D5D42E3BB 23E33CEAB61910E0 C6F881C0467EFAFA 38D7E5A316752D8F B2C75183F14DB519 21BCD15C4E2FEA29 7EE841CC5D257D81 8B5083F43A3929EB 0A1B4602D748598B B8E02EB4F5284B9D 3B776E61D82471EA 195542A357CB4149 DB3E2E07D12DA223 C9D795370A97BB6B F20BB44D30E1FF1F EA32C2DB2B9E91AB 73793E62B9C73E71 08A2D7F1C3894300 8169418B7D4982B3 D01BA86564021E75 420166F6D3C0CC03 8A76636AF29705E1 DD711C092258CCFB 03259990D1C6F801 27E7FB6025E44D74 3E594479A63D3675 DD30600CFA503501 1D4781FD8FC1B8D2 46320D71D4CC95B8 943764F2AE24EE75 FAF2ED0FEE769C90 5637391F79F7BD04 25D3D6BDC87F111C D62C84318AA295C1 09A495CBA0A2DE80 F9A96D6C5B8BBAA7

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050523 (name+title). Key = MD5(password) = 15fd87e891fbdeef9a255294590ed85e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 240b4fb5-5c78-772e-90a5-63aacec4833e
  2 69e79383-94d1-44e2-8e02-03a47b18eace
  3 deac84c5-3aad-5469-ae55-fb6ab783406c
  4 c13f086b-d1d5-7208-8614-cecee7e5bfa1
  5 be86c6e3-c8d7-3728-bfea-f6c2d4daf484
  6 e777bba6-f67e-0bbe-b3db-00d17454a07d
  7 31478e27-8233-5178-b91d-0eb4e0895149
  8 c45138bc-e106-59a1-bb6e-1c88fc127ac3
  9 88961727-c5a3-7840-8d93-372f62823a80
 10 fcdbb0ff-874b-048c-a2c9-d0dfc43fd5e1
 11 aee2148f-13e0-23f1-bcc1-17f3ad336ff8
 12 047ce2a2-3df9-0332-a468-252f7cf5aeed
 13 0392b005-ee8f-2abf-8a81-5f32cc652173
 14 b08885fc-4525-04d5-9b04-91e77cc7cfb6
 15 c35f8b6b-ccd5-57f6-8276-386a83d6ba85
 16 8fb71dd9-6eb0-34b3-8048-c46cbcb2983d
 17 63f83f29-0b84-63e5-b21d-f92ddc7ee2a6
 18 ff56cd10-21b1-1938-b0a7-3e2160e7c851

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 745730557020205361. Exactly this sequence comes out of new Random(718).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 220 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related