201210050603 10zilu

explained decrypted filler

seed 444

Metadata

Post ID: 10zilu
Title: 201210050603 → 2012-10-05 06:03 on A858's clock
Posted (UTC): 2012-10-05 10:03:06
Timezone: UTC−4 · title 06:03 against posted 10:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050603) = 0dbea602e98aaf7f1e3aa46c1f20315c (name+title)
GUIDs: 18
Filler GUID seed: new Random(444).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 222 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

41084FD2B1861BC6 8D6B2C47687523CF 79D7808975D123EA 20836892659AF6B6 95201BF17A465AD3 1CDEB07EEF429909 482C39EA19C863D2 5DC557D82BA7FF11 A441DE5B20B4727A EAAFA54A4F0F3FA6 D95DFB7FB9BC10A8 365011C894303D48 0B0942D460582AE7 DC7949576854B0F4 9FE792AAA14E096B 84146E91009B5B07 618BACEB7258FA6B 9F41F8E143BC6A36 F657BA3787B68E4A 8579FC704F1357A2 1A6267B4FD20C5B6 CD02C4A167E8730A 6A7F8CCED6B2A74A A30A2FE175E1DEC6 446F46A887EEE9D8 5570B590728F62FF 411444E258250C2A B2519B7925123AC1 B29209388C92F301 E9D4EA877B137E54 80ECCA139CD6F6C3 AAA520D8EC9880AE EC350D0AAA5FBD67 2257E269E4F3191D 5B51C8DBF00DE7AA 401D8AF476D16734 5037014723A2BA59 EAD0736D6C7E7776 6531D46C2B84B0E9 15726D85668C6302 0B8F0E52312AA6E3 F77EBC06FF269801 0B31FFA1C7DF103C D5B3F8A5278135F8 A6D9AD7F000FC186 DCC41A8F63B3729B E78E8068F14B6B58 9A7D47F3DC302349 4EB54187D3169F39 6635A73E8883C2CC FBC673C1F377AD84 A183915DF2E9026B E05EDAF74D3FE071 B9B49979967BB0C9 C914FF17D3015036 450D75282C22E184 AF7672E0A9A99DCE 8ADEC3DEFB1021C2 8799CD37B1B5BBBF E430D3770FEDDD70 F4CEBEE3E322984C B110D94488858C15 0F732F6C4CE27F72 49ABBA78DAA16F1B 2B108FDD20846B09 C778A841DB8A95D8 923682F23D572276 F5538492DF429D9B F3983E3354C526C1 3C3CD98242685627 E905901B95CF8623 434CA8FCC7AEBB7A F1F497225CD47D26

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050603 (name+title). Key = MD5(password) = 0dbea602e98aaf7f1e3aa46c1f20315c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b393bc48-870e-6102-b93a-085381ea02ac
  2 c84e8eec-bc76-03f3-9dbc-676a6c91d25e
  3 afed1216-53c7-1e77-b1dd-b6408fd1560c
  4 71773aef-4a1d-28f7-8da1-1bced1b6d976
  5 2ceb212d-4a53-5304-b9bd-8ef0b7efbc3a
  6 c5c14609-3f4a-526b-bf9c-8f03a34e99de
  7 eaa74353-ad39-70e4-903f-61174d77b8fe
  8 aa65e160-9015-1a02-815c-df5dfbafbc1c
  9 b7e1ad07-e6a3-8bf0-b10f-ed2c81973f35
 10 04b6e7e2-3d93-82a9-9934-6a66e6961e3e
 11 59288415-2038-3aa4-8d42-406d7cc695fd
 12 128b228e-3d93-01de-aa7a-030695aaf5a4
 13 42e0d43e-89cd-79de-986c-68dbb489c5af
 14 fe8b08cd-bb7f-42bc-b669-9981a98f432f
 15 b38215c5-4585-6e57-bd88-49a6dda23623
 16 fb8c7dc9-506b-250b-ac10-50e6ca533d9b
 17 b8e4fcea-da73-4341-8a72-623917c0c46a
 18 02c0eff8-4af1-20db-8ab7-437626308a25

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 601255718830746242. Exactly this sequence comes out of new Random(444).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 222 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related