201210060824 111f4i

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 827

Metadata

Post ID: 111f4i
Title: 201210060824 → 2012-10-06 08:24 on A858's clock
Posted (UTC): 2012-10-06 12:24:06
Timezone: UTC−4 · title 08:24 against posted 12:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210060824) = 5c88ad265ad69bf2861a304f9ea3ee66 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(827).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 301 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 6
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F55A36C2ABDFD8A6 73E1CF6DA2C706F7 59A7A565C0E27BD4 44E319DF0BA13623 E55CB12C59503929 B3399CB82700805E 555B0A21498B78D4 391E6BD95ABA5501 DF9D1D6764F0CBF1 CE63BA6C3EF75990 12214D8A18F24F2C 59942B6DD802C642 490C0D9D1B68B39E C7C33975C6F1BE60 E6927A2A6E2C9C15 F145F0D493A31464 F3ADCF126ECA3C35 C3A5276C226EFC0B FF23BBACEB1EE61E 9843D6F7893F7EAA BEAACC0414E5641A 1A0B88A472421B62 C112441513B0E54A 4BEC37F17373C6A7 A22CF67E247CA982 60FB9B5EE45E9F24 C437576A4A1EEEA6 550C74E98E4A3B83 D61C84BB260C445C 9B0CC457609ECE01 6CFB01E5F8B80D20 74AC114241F678B3 84D5E584AAC65125 3CE5B91DEC84D208 771C6BA017BB4BBF 113C08F35AD999CC 5B928A333CF93438 F936B7C6AE11869B A6686DDF50592088 329308DB665DAB03 02138AF775D5154B 65159C5E37D7FFE7 CF54192B913457B3 25C0764A280A524F BBA5A080FA8B84DA BECB38DDCAF988DD 9FE2876017D5B90C 5062EAF82AD00BD7 64808B49DF80AE3D B2FA5D9E6CB5E771 8A316FB9CADDEE16 A43DEE86E442984D AD55F7A2AED37969 BF9DC82868A69707 8420622ACBCE697A 952B8E748793C164 FC0C962606EB72F4 C1976F6512ED904F 07C09EC22C81BA8A DD2FE7F3C8A0F121 B9DEF75234B23394 5F9E4D66929C5025 84E397AD27CD9E5E D721C7344EBE9EEE 937A8D401275B17A 3B9FE48FDC061011 6D5A1558420C9CF1 DB6ED53245C2F538 4B4288507BE0AFB5

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210060824 (name+title). Key = MD5(password) = 5c88ad265ad69bf2861a304f9ea3ee66, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dd4bdb49-4f9b-6cce-b403-18a49a5ab67d
  2 0ecf238c-3e85-4708-b8f7-0c94462bc413
  3 68c94bba-e9b6-71e8-a3b7-fc1da4e08da7
  4 5a99bf17-885a-0e1e-b6eb-0fd847a297fc
  5 a0c81806-5d63-59fb-aebb-2a5eb1225dea
  6 46c9f2b4-3ce6-28f8-bd67-74bc3a1e4b65
  7 30593090-4caa-4904-b476-c8628fc97eab
  8 ea0d1b82-3422-3af7-b9c1-bd9c77fc8e02
  9 84b92301-0d70-2e22-bd83-e33acf380172
 10 54b02a93-e6de-294b-85a2-d9088b8ffbc7
 11 33d8581f-92cd-5ceb-a20b-fe62fc72ad74
 12 cbab5385-51fe-1fc3-9efa-8c72220a1648
 13 07ff9b94-c3e7-1459-bd87-9cf4552f5850
 14 db814c6b-45a1-66ca-aed5-4112fb12f478
 15 81bd729e-20d9-77da-a94d-214a72db1408
 16 29ae299b-b4d3-412a-b6fe-43fb859ebad5
 17 9b83cfb2-87bd-4882-9e31-554daf912374

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 64705243225116744. Exactly this sequence comes out of new Random(827).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 301 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related