201210070324 112w6x

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 233

Metadata

Post ID: 112w6x
Title: 201210070324 → 2012-10-07 03:24 on A858's clock
Posted (UTC): 2012-10-07 07:24:53
Timezone: UTC−4 · title 03:24 against posted 07:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210070324) = aa862daeb28db1fef4c3ca53fede8edf (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(233).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 358 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D3670ED1892D9077 8A08A9906C9FCE98 2BDB20E3E3AB7661 3CF6A93A23D4E7E0 1AEE95C3604BAB6B 04D340807068C52E 5A43D55D08A2D74E C97C801E9CDB70E5 69BB7F043FEA8DE9 DBA66E9C7711A04C 466E7E82FD3FABD0 A913D0FAAB8A2D9E F772E0BF3BFFECD4 321630949D39A8C5 D591D5C5347D56F7 D23546BF15E237CC 71434D2A7B7EDDB5 E4F7CDB5C7B2F08D BD14B44F133E722B 0C9A32E47E18048A 0B6C1528CBDBE2C8 6EC2DC4612F5FC36 BA2C9E7837CAC5F5 255DA4F257C69BB9 817F92F58ECE9DC4 100E8D86F365956D E40374F6FDF9800E 4364D65AB86B6A3B 5A53CA778DE4ED2A DD1463BB4FC3EED3 47841531DC3A5EBB A41EF2261C648C9E B16D4886BF5A87A6 1DA9CF58F1211423 E4A48F2EFBFEF186 B577D61255C580D7 07FCD0C35B293157 EED94D7E77C2F6BE 99D209151CD1D4B1 425933FD57083A15 9BA2CC8F0F49358F 17A0F4746B0EA9FE BA7A830E08939DD5 8284C7144AB8716A 98D292393FFC9916 E6DFACC75DBC234C 0DB4EB3529CD2682 6131BEFD205DA6E2 5D23A0699D6FE70D BFC46E2C16B8D5C1 FE5E08C2E68F9CC4 850E94301884972E 4BEB843E75B2E397 F23A5F06475ADBC0 B1D47EC45D6D7523 8BD3C67029E52F5F FB4AAE7760758AC1 9A1A7EE178754A62 FC774C5E12772283 A037BC30F824699E 6F6DEDEF1F6F211B

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210070324 (name+title). Key = MD5(password) = aa862daeb28db1fef4c3ca53fede8edf, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 85cef29a-74fd-4d69-9756-d4c49e418943
  2 0bca5863-239e-170c-ace6-f7f5a26fc5b3
  3 90cbfd3b-8af0-576f-8515-b3e542eb474e
  4 0a07709e-a443-2d34-9613-51ea71af56ae
  5 15550a67-4b5f-3bf9-b4c3-5dbae4210551
  6 8e919708-6a6d-1ead-a845-4f0125d7d297
  7 1d24e1c2-b31e-243e-9ba0-6e29363cf184
  8 164509c7-b520-341d-96ad-33895a1b7431
  9 1da802e2-79e5-7cd5-ab62-a47118bf64f0
 10 cbc61952-c92b-15f8-8320-b308ff7771b0
 11 e7c6bba5-b23e-8ac6-b199-93941976a9e0
 12 859de6a6-e135-30d5-a75c-bda357f73878
 13 75189fa6-b0e2-78b0-bfdd-542ddcfc8921
 14 bf33df34-31bc-6da4-ae43-d96e52ec3e4a
 15 bf909e22-0acb-0209-830e-dba98d886b88

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 415231237183760. Exactly this sequence comes out of new Random(233).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 358 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related