201210080725 114sws

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 447

Metadata

Post ID: 114sws
Title: 201210080725 → 2012-10-08 07:25 on A858's clock
Posted (UTC): 2012-10-08 11:25:57
Timezone: UTC−4 · title 07:25 against posted 11:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210080725) = d8d84220c7cb89b3d3c9b06049694693 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(447).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 442 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

633A8F4D1BF07572 C46E325DE021E342 8B1C2556CDA48465 5C3D89BAAEECA708 1B6028851598E015 A523354E0C69E931 409173186895B790 EC3D3D6D16C5EA90 376B3F760BDC4BF5 2411C1031EC3B7FC 1BDC6AD89516570D B6F871193FEB3D19 1C1A7171A73AB68E 2E4EE0DB74FCED6C 8BF93CBE6009949E EC46F4E95A09C959 6446E0FDE920CB6A 064DB70E60DB055B 966AFFFE35DDEFF8 97C489C43DBD1EDD BB2CD02229F5D1A2 3CE65464D14CA3BC AF9F5090C7136867 CF15CB09F11D7CAB BD975ECEC3CF5DD2 5954D69057D6C75F 8E7D6C5167B8205D 5F7DAFF2FC63B221 773C3C801FED1AB6 CCA38646B114A6CC 640C31C3703A26F0 4A16D4440B8AAEAA E708B0359636D256 C664DB1428BB7C07 41864D06E5F728DE CEE77EA20A928AD2 B9140FDCDB4993F2 83C332F58FDFB38D E7AAB0CF8038509F 23B81FBCF438E195 F124B03746262253 E289E46191BA3523 C892ED60FA53710C B4AD792014270C9F 25C2C3382F4377F7

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210080725 (name+title). Key = MD5(password) = d8d84220c7cb89b3d3c9b06049694693, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fff84d55-f61f-2293-9205-beeb8850f4eb
  2 bd831b7f-5093-8681-b585-c76e3d662a1b
  3 2d7d4d4a-fc60-15d8-a2ca-cf0e023a4d46
  4 ba97891d-88e6-870c-bf0a-03da14487bca
  5 8c2ff54f-7895-0d5b-8029-e902275540a8
  6 d32f895c-b485-161e-9ac6-9af78ea19982
  7 6473e19e-4045-1d7d-a114-e2c33b771ec6
  8 0a4499eb-66c6-696b-aef8-57928d434e0e
  9 0e9fbdba-0be7-29e3-865b-bbb50762dc08
 10 1311dd61-03f9-09b4-8e7e-1640e855e9ea
 11 20af611a-4eed-52fb-9e11-455bfd40c42d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 28180116205. Exactly this sequence comes out of new Random(447).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 442 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related