201210070725 11315k

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 636

Metadata

Post ID: 11315k
Title: 201210070725 → 2012-10-07 07:25 on A858's clock
Posted (UTC): 2012-10-07 11:25:01
Timezone: UTC−4 · title 07:25 against posted 11:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210070725) = 89233607e96231c272487e36a0bcc216 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(636).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 370 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 14 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6E6190339E3D170D F97D69783045B97A 651726F7551C48E2 AB6CF3BB38936236 0D0199CD6291A854 3C5759911E4E6C6D 394A0DF3BDD05AF0 357F6F49D814FD51 0955D58375A29998 D1677A061281A575 1AD77878A7A42278 0C61155D616E6956 5C4705CB3680E1DC D5878A4FE0C98BEF 8CD8279A74781D00 687E290DE1AF59A1 9832B103AFAD9FC5 0625F0BA74DFEB5D DC498D810FF2D6B5 ABCF05A1EDE611B8 9997943D6EBB6990 1ADB38F96BAA96FB C32419F89B642D59 374C259F96B3CC07 AFA02F3F3B3E0C49 587A452453FD2F7B C5FE0DDA39A1948F 8DEA97DFC18C21B6 A720001FCB25A665 6678F44FF3E4E288 52B8FF7603971311 C61B9636A0F28DC7 1E6BFC0C1D860ACF 309C2FDD8BFFE2A9 19079FD0936AA80A D20F3559CE9A52DC 27B236331AEF504F CDB08B956496499A 598549BFEA87DB9C A8B870F8C7C905B2 E135F129E6B65D33 912803BEF04A768F 59D28FACA2A044C6 260BDD7930E8CA29 9773DB9BCEC53E03

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210070725 (name+title). Key = MD5(password) = 89233607e96231c272487e36a0bcc216, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 55b2ef88-ef35-8f2f-99d7-9329460c9631
  2 8a66e311-8a1a-3ebc-a6f7-bb57a63cf476
  3 6612306f-b159-2349-80ea-4e8b86eba3a9
  4 9c5fefd6-a130-25d1-afda-cf340e8b5ea4
  5 1682d97b-81d1-369e-a8ff-db83c1c77a9c
  6 4cfc6f6d-b1c6-3247-b9b7-d81e0f4e240b
  7 9e4d0617-fd52-7b29-b173-1e92a9f74270
  8 e83b85ab-ed9b-4d27-9ac6-e53f5a339557
  9 1a930596-c83b-54ad-af2e-f210ff4a961c
 10 16aa42a4-7243-7f06-b70e-a4261f31057b
 11 1e3e8c52-5fd8-732a-b891-53a9cc4b8a76

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 83223374577. Exactly this sequence comes out of new Random(636).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 370 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related