201210070304 112vnx

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 299

Metadata

Post ID: 112vnx
Title: 201210070304 → 2012-10-07 03:04 on A858's clock
Posted (UTC): 2012-10-07 07:04:52
Timezone: UTC−4 · title 03:04 against posted 07:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210070304) = 501dbf9c3f39872339d61703beefaa5c (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(299).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 357 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 23 · 3
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A734AF7EBA65F953 CD134E1372FF0CFB 499B4D0075059552 9826E2746401B99A AF5360FC3335A201 E22D549548543579 81BE26DAB2C93BFC 1CB2527DD07C15D8 C414F85DDC17D5D3 408985D84981C3D8 4B652D967B5BD0C0 41875481050366AB E46A1377984CEAB5 1ED05C850E2D4B21 34A49113A756D3A0 1095C245A98171C7 F3BF502F17E86DE9 E223BE20E4031C3B C72835B8E343956F 953F7F79495FC3FC 375B5E633F911FB2 54C1B2BB2773B8B3 CB54DBC883441182 E2E5B1DE7B3C148D 1BAA6E1A8691A820 08573A9FC29FC6FC 620C928345ACE3DE C2B7930D8100A496 4C4C14DA5ABEF1DC 9F4FD1DF1DDD77DD DA34AFBD925331F7 70881BABFDA779C5 227D31EFFD4368B7 3C718BADDCB7FCBA 4C5796D5FDFB65E8 03E1D32DFA654CE2 FAEC85F8123E71F6 7CD9DE0EAAB90C8F F40EA13590F913F7 4A57CC45B99ECECA 310C7F80E9CCB9B7 9D949A84C5A84254 FC4C6A837DD10FBA 48EABD6AA9F7CA1C 29B990520DA7AC68 6DE7F3408095F94B 6780231F86392D5B A608E169DEA47AA6 BE2222694464D9FA F7BEF0B910CE3194 A2F867F37D8F3AC9 D8865AA810B043EB 9861C5B5270C3218 4790649816DD1EA6 0CCCF7BA80AD1168 3D61E4FD8049CF19 8E58E369B0E92F00 01F8FC07C91ED75C C8E8431ECA186B12 FB737F22393B2FDA AEEA0FD9669EF721

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210070304 (name+title). Key = MD5(password) = 501dbf9c3f39872339d61703beefaa5c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 616b5442-22d4-8ce8-be0f-5b9eab618c59
  2 f96a1982-7287-4439-a703-2ed51376e1dc
  3 451f0e2c-7f3c-6c76-91bf-89caea86cd7c
  4 e731be41-3071-39c9-af70-133887e28bac
  5 e273210c-ffd2-1999-89f8-6786e6590fea
  6 67bd3944-994b-79d9-9fe7-0d505bf52a13
  7 7df6c5b9-97a8-795d-93ea-4a0a4520466f
  8 23a4f61f-0921-41f5-898b-aed08863d058
  9 4ce17271-d5e8-8946-8def-b4dadf77bec2
 10 cac4ebfa-52db-475b-957b-37cfa03aa2ae
 11 c61c555a-383f-5236-ba62-ef1b80cce1ec
 12 fb745d3e-2a64-8968-9a9a-1e7c2f5e6442
 13 5869e59d-46b6-1e57-b1bc-c0860db98f69
 14 fe9c393f-eb48-0048-81e4-469469cbb7aa
 15 ce450205-94e6-23d9-8ead-50a3c8e01b90

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 846317748458102. Exactly this sequence comes out of new Random(299).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 357 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related