201210060924 111grn

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 786

Metadata

Post ID: 111grn
Title: 201210060924 → 2012-10-06 09:24 on A858's clock
Posted (UTC): 2012-10-06 13:24:08
Timezone: UTC−4 · title 09:24 against posted 13:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210060924) = f1d7a8643ebb5b1edd5a2ac66e4ec1e5 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(786).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 304 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

097967A5BD261923 3D3F78982459638B 26CFA31BD7DD14AB 75C70F3B534AF9CC 245796EAFEA3F591 1BA24E5EE25D0107 FB230DFBE6EFEE6E E21EA3BBEDEF9C48 D3F075A131077483 CFA7C9AFD026640D AF1DBAB4A6F07666 75BF7F66A82FB2B7 03F0AC68F21A4228 400E14365CCB9D44 AB44AB855E204882 6F1E835CDF0F6AEB 163A2CF9CE9D54CD B125303B031C5D21 7E8AB0B8ABC46594 18D5999BBB4847FC A4A3AF3C7E445620 F257124E04540B8F C605AA7FFD6E3209 69DF50B6538A54BF 637437646F9B17B9 6C006DAFF3CC2367 E7732F87E0F65133 E78A6A446BDBA808 0083BFA460FF5320 14017DE5A7921625 6A47436230B2BD5D FE874E1350F49D62 403546D52C55FA6F 5A137FF3B716D951 346A2E8AD5EB8904 861B13D86D0EE25E 12C813C561BA6DFD B09F352A0BF2733C 5261B06B96A9E0CC 7BE75E7759900CED D2EDB674B941728A EA598785528E440B 00941FA9D60F5D6D 9DCF9BCCA6315B57 EF42BE72075855BF C287D1B57A757D8C A668722EB8AA1FF4 F49832AF9A893969 7AE31AB4A493CEBB 59D035B9B41C394C 2D508F74CCA38897 8C713842DF3C694A C3E711034007B51F 995CD952C6BF9E11 5FD27A20A13536CC D8385EB677FD3C6A 17FF4B0D19C5DA75 292EAEF4809A64B2 842462CA520C9F16 3FFFAD5BBCBCFE2B E1BC2D2C8723AF29 AE9AF31E81EC159C 6EE71B4D94A97B44 362B9B0F380E88F3 C3241033F3C62F6E 492762AB8B7B8533 78F0387EB430CC5A 14635A06451EFEB2 D95ACB3C638D1705

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210060924 (name+title). Key = MD5(password) = f1d7a8643ebb5b1edd5a2ac66e4ec1e5, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2e11ecca-22b3-3410-83f6-8e2f1388cc10
  2 e304c073-fc95-3e16-aa31-fdd4aaadbcc0
  3 d9b46b84-4975-1ed2-a11c-5795b870e945
  4 76d56399-2eb3-293c-8483-a647e4c55065
  5 459181b0-0606-0cd3-bc6f-c0aec1a0ac35
  6 6eebf2c5-04f1-3cde-ae76-7bd084089a73
  7 ac6f59cb-4a92-0887-b5cf-df20a3de1542
  8 91aa0c71-d07e-65a1-b869-15a291478d41
  9 96657ccb-1203-19e2-a8a2-e023c37d8775
 10 21f53219-e910-15f6-8761-7e79254706bf
 11 e17d9d08-4147-3364-91e0-50b4742e49c0
 12 64f058b3-b56c-0642-bb65-097ee7d68eca
 13 3943b598-062f-8571-b3fa-f71dea3ce2c3
 14 9a64d29a-294d-392e-a35b-1e8422ab7239
 15 bf2c1859-3a02-1629-9d60-61ea143abebf
 16 5c7e96a6-d173-8d04-98e2-89a9af970915
 17 8f506f05-dd12-26e8-8104-f9faddeac090

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 33120306113083182. Exactly this sequence comes out of new Random(786).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 304 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related