201210080645 114rxa

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 859

Metadata

Post ID: 114rxa
Title: 201210080645 → 2012-10-08 06:45 on A858's clock
Posted (UTC): 2012-10-08 10:45:55
Timezone: UTC−4 · title 06:45 against posted 10:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210080645) = 3132e220c991fdf29006e58bbe50df81 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(859).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 440 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E5520681B4DA035D 1354CD8E9142C015 7561C1FE6841C5D2 E5A1223DCA6C6F4B 38C60BFEFF90C539 C7EB4E617C664727 74D2D29797B94C2F 2D2A0232AC7255CB A7E10553128BB6DC 6FCFB839387B9E27 173344C1A4C5AC65 9B2B96A7F2CBE86A A845B1BBFE73A5AE 093661D62217FBA9 698EA2943F389A99 DF07EFDA32B6D9B2 9DB9F19C3C59EA6B 736DADC5A55F1D9C 6BCC61CFE505888E CF4AB7D5278FB4DD 71B7B6EAE53A01F8 2F3E9F40D18B49AB B665237A351A4474 C182790C91C12B7A CE9803C2B7E4081F FDAA0915FD62899A 568BEDD3CE3BCA4B E695D258EC546C48 1BC4C9DC505F3DF2 30D57E6CACD35B71 93E45D86DAD0319C 792FF5B58C2D8897 E84E1FCB846973A4 5A77E3BC8885A529 2DC60F0646C1CF44 06673B7C9F16CDDA 2A3B3C0554F30A56 B27B96984CF4621D 978D418BB2243972 5A3B14DB2C8C8FFA 5EAC2360BEAB60A1 D6C21E8B9B3BD5AC 791E6539B2710C4B 0879B48EFD3330EE 08765A49DCBEDDC2 621039B4A1D9E6A4 27E7CA8B453A3FB9 68456D8177A022E1 80DE80A1508B1D32

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210080645 (name+title). Key = MD5(password) = 3132e220c991fdf29006e58bbe50df81, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1d81c486-c6bd-4550-9568-354478a50f8a
  2 bbdcef8a-b814-71a2-be2c-740e1d6d6f89
  3 1285102b-3d3c-1f5c-a9b5-63a45943cddd
  4 3a7ade53-e129-8b23-ae0d-c208014ccf60
  5 55bdac1c-0eb5-0c2a-a181-e118830cccc2
  6 8a63a727-6aef-2fbc-a372-c09c46c09de4
  7 5dcaf92c-3c2a-7d33-97d2-64ea910250be
  8 c56e948e-6e4b-31b4-9b28-b27e61b150a3
  9 9db69062-a594-2521-a307-fd8349af150d
 10 f27459bd-8ab6-0a84-bf27-6f1a0fc8c0c0
 11 f983ec01-2b70-1a2b-9fac-49560cb08f54
 12 ba4c3148-e7a4-0c0e-9f2b-c644a81619ec

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 471802732010. Exactly this sequence comes out of new Random(859).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 440 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related