201210060544 111bsc

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 140

Metadata

Post ID: 111bsc
Title: 201210060544 → 2012-10-06 05:44 on A858's clock
Posted (UTC): 2012-10-06 09:44:00
Timezone: UTC−4 · title 05:44 against posted 09:44 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210060544) = 644c619a2b0dcd2d76353b517f07853a (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(140).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 293 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9E5B65D9CA3CF9BF 6D2D920EB4EF5D13 F2231B2F140F478E 01EF525B7D83DE31 58F89D9E265D217E F8B1EC1896A8E081 817380742049451B C6D6B148559B76CE 5987C63F580AAF26 CA4BACC36B04FB12 A491778933AFBCAC 4A14FBCB6341769F 3D69BD551C485FA1 700C7D82172A733A 7D8CA97B737C078A 0BE2D63E557FAC66 32347B3791AB280E 257FFED468F4E62F 3633C8D0116CB550 C93ABA0482FD7606 981AD0CB4D6D21CB A1799A315B9F54E2 E2D40403BAE6A064 4418F75DD44753FA D6BA3EB70F2FDE1B A704243A22DE2F0C 253D81F87CDA5168 965CD49DC4564607 BA81CF44D474C185 AD5DE4BA248D45F6 4AC2503F01FD1F2C AC795ABA7C9F373E 9906219F231201FC A1C6FBD17B634A10 4A91C33792637655 DC97C3CD07C9DE1C B001019A0AB6D7E7 B1538B543BDA4890 011D50DF59ABA984 2F5B75B30D5AAE97 E535F39539ACD4B9 5A17E65AE9DC3738 034CD32BBB72C949 5B5F35065DE2F5AA 1EDB78F5FB9CAAEA

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210060544 (name+title). Key = MD5(password) = 644c619a2b0dcd2d76353b517f07853a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 31165fb5-498e-7102-a903-3df749466342
  2 df70c11b-7f6e-84b0-b443-2b7f8e0b578a
  3 f714ead0-aa39-592f-9189-58ef6867b1a1
  4 1a65c015-7b64-3b8e-b29b-9e5d29808e70
  5 dc619efe-3eed-36a8-9028-41eb308ce2fd
  6 22b9fd21-8b61-8f44-92dd-dd6d81a71c28
  7 0cfaaecd-8127-524c-950a-27fd04f42727
  8 ff2642a6-3987-6ea9-a15d-42731aeda86e
  9 f12f0f98-07fb-2b05-b97d-5e7e0c62b736
 10 f627fd6a-d1db-8e83-8733-122036b81d38
 11 9c87ec47-1dd5-3ccb-b210-ca30b0db7851

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 78533856283. Exactly this sequence comes out of new Random(140).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 293 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related