201210060203 1116hk

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 326

Metadata

Post ID: 1116hk
Title: 201210060203 → 2012-10-06 02:03 on A858's clock
Posted (UTC): 2012-10-06 06:03:54
Timezone: UTC−4 · title 02:03 against posted 06:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210060203) = a9c247ef1986c2f5ac64920bd6b1b055 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(326).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 282 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A3E34BE3B7D22B23 AAA26E7651C69F76 B8312C35E8FCCD6E 258B156219FD486F AA329E8EF2AAA964 94FE6F617BC778EC DAC8C37812883E55 A43DAB89EBD15E18 BD1169D15F96B195 544AFFF835AA7D46 CAC36E962A4E5772 682880DF060B3950 36E827D6D70A1379 0AB0ABF0E590AC23 632743047E72AB78 7BE752BDB06F8F5A 868AE03C39289CC3 14AE8BA2819A98C0 E2755350AB541AD4 00ACB0B80B32A4CA 846B6463FCE3CD7B 319F2B4715AA280D 2E670C4F99D11BBA CB1759D33766B20F B7C22401B401903D 51F98143049DD54E 32142038C5940650 DDC812ECDC887468 38C69CEDD80DD8BC 3C5098B92CDB8076 D5D89B9248F33F2B 6A18B29736721CE5 83B3D63123D71662 0752C78B7A6DD410 84B4A0592C475058 1221147527BB1805 FD031AB5F2BBD3F9 1269B84D19C1140E F6BCF0F65CFD4057 4A143A53AC6E8453 CEEEE48987CBB92D 85A78E3C17C6AFFF 3509801233446981 55E268D27FBDBE9D 87BD833E66F9D06A 06424B6E7F1435CC 35E228BFC6D64C89 5CC6C65C7EC5743A A66703B9052D9E5A E226D9B82C59CEE3 45E436A147D00C97 D43C0467245A281C 2060DCE1B91C20F3 13297DB4B6D8F6A6 65D01DB3F752A123 0300DA58138BB4F8 59722F9CC135DA0B 6A79BEFFF212277A 91E98CA096757E41 E17B2B5F5B522320 77FFA860D23B5350

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210060203 (name+title). Key = MD5(password) = a9c247ef1986c2f5ac64920bd6b1b055, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f8b0f026-a2f3-0834-b001-c690cc6e7070
  2 f2dbfbf3-203a-47a8-9a26-738171e8484d
  3 9bbd795e-8448-5a7e-a042-ad0b064e3161
  4 73fcf1e4-08b1-1e75-9d28-0df60ed8d004
  5 abbe12f9-fc6a-3e7e-8168-1c3fe0463be0
  6 2a42d5cb-5fac-4113-9982-110e17494a4f
  7 220212e6-646f-8c22-88dc-4b8da2d4ca21
  8 63897679-f9ce-8deb-bc13-7458e056136d
  9 efe86489-cf5d-2085-a5ce-da03db3ea39e
 10 a9e3e565-91ba-4f71-93ef-16c9bf61237c
 11 964eaad2-0a0f-4faa-8dd9-18e4a343cb06
 12 bee63544-8ccf-8a99-b774-4c5638296dad
 13 ca71849e-b219-64a6-b174-5600f3667a3d
 14 86848f2d-0488-0533-ba47-253af325fc7c
 15 e7abd0a4-963e-1625-95cb-df1c16d8099e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 045134882448601. Exactly this sequence comes out of new Random(326).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 282 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related