201210061824 1127qx

explained decrypted filler

3DES(name+title) ECB, 16 GUIDs, seed 163

Metadata

Post ID: 1127qx
Title: 201210061824 → 2012-10-06 18:24 on A858's clock
Posted (UTC): 2012-10-06 22:24:29
Timezone: UTC−4 · title 18:24 against posted 22:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210061824) = f470475d2547f8f7617d0d795a581ce9 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(163).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 331 · predicted N = 16 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 10 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D6D6888F854619AB 02564CE1587CE233 309AB96CF4BBF3DA 9B05D1B24117A91D 5818F65F2D9A4ABA 59CD8E890EBC707F BB6BCDDB054B37EB 41CE0135AEAD99B7 D804BC8F7353AE2B 4EE3D512E0A6DEC6 AE5604CD56E3290B 8C66986BA63861F2 C937F5B1DD014E2D 774ABE6BCB604183 ECF5FDF9B7913718 E0ACB6330EC6B7D3 0B73F3AE0A40E424 EB29A605F9B9B71F 8DBB9E78B29007BC 5905D02687B32005 40354276207D8858 BC8E11FC34B05859 2D66E5250454A4FC C7C2C3DC4AF6DEBE 9BBE47E6A8EAC146 3C2CBC3972B8ACE1 4F02064D4058B5C8 894EF15F9059D58F 2A0B540F68BB42AA B2AF3E5881141214 73B379524E5A0E07 FE2AD06AB5D386D0 754CFB1ED4B5280D 1C18D0726FCA8D81 144F46DDDD82A9A7 45BB5F5A6F409628 854416A494552251 4B3669B95E815012 E073E189DA03D191 14CB4C483A4953A2 B151E118ABEF898F 585EC5719C517309 15EB7BAE51F66673 D599A33AB4EAAB12 C014258212EE14B2 991CD0BEB4BB32DD 82A4EFDB9182DF02 2C626E7E238864E4 361BD92FD1B48CD7 AF178324E86F8C1B 23355184CE6E522E 907358184311F10F A892D0F2E6BDA31A BDF9E54BBC8A0FA9 A96EF112CE8B4936 28DAA6F778F2D276 F8A2EC2B532372D9 8533F84F81E2D7A9 0A2230B47E4A3BB8 57E1F4F8B58DBA77 54E5E263BCE1B2B4 23A225FBC7781797 1164AFE444444E6A CC074B926F42D6B1 D861FF65F73EA1B3

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210061824 (name+title). Key = MD5(password) = f470475d2547f8f7617d0d795a581ce9, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 12b5c7a2-ed03-7185-9a88-058b4dc59252
  2 6aa1557d-35b2-5b4b-8097-66b66e56ae70
  3 7b3134de-7b04-6f99-8635-0cc9b83350b7
  4 9a91f625-2b7b-358e-8e25-5491fe6a87ec
  5 b592cc53-a0a2-71cd-ac0e-d81ff866e657
  6 150197fc-4e00-0579-8435-a49b3487f29b
  7 23984ae9-1d7d-8b90-afce-522d3cb71602
  8 09ae5f32-827a-1fb9-918d-b5afa84d54ba
  9 a8ad97f5-1337-1e40-9984-b33191086fc7
 10 691bbc36-a350-3960-aeeb-da6555982870
 11 ceca2823-3356-3f95-8b60-d92132655692
 12 652226c8-3c75-60c8-bf83-ed4638ded6f8
 13 39cc6070-f1e5-6f44-9f68-18d7eb015504
 14 2ec8d7d0-aae5-28d0-95da-74f28509429f
 15 38d2d9e7-a15d-0553-8fa9-c5a5858267ad
 16 c4961fd6-b181-7560-b73c-dac1c17af227

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7563708113366207. Exactly this sequence comes out of new Random(163).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 331 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related