201210061144 111maf

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 313

Metadata

Post ID: 111maf
Title: 201210061144 → 2012-10-06 11:44 on A858's clock
Posted (UTC): 2012-10-06 15:44:14
Timezone: UTC−4 · title 11:44 against posted 15:44 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210061144) = a4aea23a2eaca29018f5ed3a1fe4edc6 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(313).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 311 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4D2330C015C90FBE 8F18EC1A01F17BA3 034D3EA7DF68DDCC CF895FB272E22597 4837757AF325521D A25B5E0A77C10165 87E35E7305E4F46D BC8705CFBEA6EBDE FE2B8ED5D695492A 8EE67699625DC5DF 7627151D6F258A91 E066B50FEC2949B9 A52CA27D45460047 8C135373DB13C0D2 746EB6F1591E3D3A 217DE281F111578E 3D0A0A228B055EAF 09F04275648383DD EA63F203BEB95DDF CF55E9A57E6C3A4F B70B12ABFC36965F AE3F793CD721769C D9344F87BD747C75 23B9F3F5B038FA73 A97A986944280766 065A46E73EE583CC 699D03BFC5F6FEE0 47C33998D4354D10 AB30C08D585571EE A3BDF8530B967209 ABF13F1BAE2E79EB 4711344E504C3B03 FB83946138226193 DD68EA7B96278A73 E571FD7CC978F4EB 53C5F5ABAF28003D 5C44223840B74AD9 82B9906A9E82A306 E98D7361EB4BA4B0 FD5466667DF75282 0CF658F50090B231 CA0F1C8D4B349A38 F5EC83A0DF9AE5BB EE3DFC6E67080716 983EBC90D8BFCC1E 4AAD2A968F7F4787 E35E437F530CDD43 ED6B50FA65E2798B EF4892D59C1D12FB 31756580743E2FD7 E00A11C53353AF93 2AE70BDDD00252FC 54A5BD377E31FCBF 5F8042F1FB3484F6 659198335FD1F258 FA6B377929701E35 66082EA3602AE5BF 64D37CE905591F51 E5F2E13E6CF3D7DD CAB08EABE1816935 BE469704630D69F3 9EB3AF9CFCAD035F B3D8160470E101A1 7FD1329F7E222D10 EDB5B417EAC71EDF 471B967C79EC16A3 C0D8A876750EA7DD 94BC693D12A9E076 74A560CA30C33DA7

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210061144 (name+title). Key = MD5(password) = a4aea23a2eaca29018f5ed3a1fe4edc6, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d47169fd-8621-290d-8135-6ba892004934
  2 b2f7b806-4dcc-524a-be6a-f5de5895a478
  3 75474607-daca-415f-905c-5b8362c0398d
  4 8d6ec436-a982-3d6f-a773-61067ff49e69
  5 9a091a2e-bd29-45ad-9b6b-fba89f89c957
  6 28eeaad1-14c8-0531-b778-57d0e20b2989
  7 d8a8fad6-129f-1f8d-a591-e15d071bdb45
  8 1fe08060-0d5c-42bc-96b3-2fcdf993b3fc
  9 57e6a0a9-c0d6-6e7c-80d3-644488bb2f14
 10 a443a054-2ed3-6ba8-b892-4eaad885298e
 11 79f2a233-4f9c-70f0-9159-8ac7cacc1f51
 12 8636650e-4650-7acf-946a-451903cbf34a
 13 77a6c3a4-d46d-7929-8df4-f3bc09adbda2
 14 a903af19-5552-2699-a4e5-6968695f64b2
 15 63b19251-30a8-0705-951b-f606ba478d6d
 16 011552f6-19bb-4009-92c3-ba6fa55611c9
 17 786a9893-0b4c-34e6-ac9a-b4416bc8c0b3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 25434014667772043. Exactly this sequence comes out of new Random(313).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 311 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related