201210081046 1150nh

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 976

Metadata

Post ID: 1150nh
Title: 201210081046 → 2012-10-08 10:46 on A858's clock
Posted (UTC): 2012-10-08 14:46:04
Timezone: UTC−4 · title 10:46 against posted 14:46 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210081046) = 93c9fe58b237e7ce4fd541b360fecde0 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(976).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 452 · predicted N = 14 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D5181DF2FE0ACE17 A4F513BCB1AE835F EB195DE33F57DACF 1259757D5C97E954 5A564668E0444552 5342C3A6C6043576 401D066FEABA9D5E 95DC7C757D5061ED B84CE2ECEB08CAE5 33FDA829170A0742 F2CDE8A6C0BE4754 FC639C9E8DABA012 9DBCC46E1FB19729 FB3E38B5DC1567C1 8712275699B8F3E4 CA123FDCA489AF6D 28D6052FC93C7B1B 12ABC6807C805C29 331A752F1E2AB3B3 9209CD8F25E9F5E4 DD0F3185CFBB4630 FE15B1BF7D33DE0B D65F4815A6174AB7 5CCA227D5BFD57E6 1F01E90A543ACD8C 9899074751127BC3 C9586305EDE0ED69 72B1B009B04B2524 9EF720E3C8B2CF51 29A0834F3B46C376 91D7D0600FAB81BD 962EEC99CA57BF06 ABA8BE216FD78F4E 81662E4136A63C11 F31537FCF9FE4643 BFD1077BD0D12EA8 1B8C91D82248687E B3FFD5152AB6C106 5FEF8BC3F2A5563B 7F078C030C8ED14D C0E4DD96B39222AD 8104BAA75B235808 E3BC240EF1643FC3 049EAF81A0FEF20B CDBA5EF93A6BB980 E07823A31AEDBA90 8716EB20BD57C1C9 D6BF4B99D7DF9EA1 B763A2D9E192AC62 452FC04A38727BC5 47DEE9820DC18159 E20A6EF44786EE16 CC87214C4605D6E8 B9ABB23A24170638 C6F762421A5557D4 056EA69CD30ABF2F B5812AFDBFF318FA

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210081046 (name+title). Key = MD5(password) = 93c9fe58b237e7ce4fd541b360fecde0, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 72dc6e93-1d1d-5914-a76d-006a366358a7
  2 2ea52388-0a42-1c20-9785-67e34b14dc44
  3 af1814d6-f2b5-8578-a6e0-491cc937040d
  4 82b8e887-53c8-7a1f-bb86-729596168900
  5 5a2eedf9-8956-7d94-b3bd-afa3bfc584ec
  6 5b115008-b6c9-41e5-a10f-885b593a791f
  7 977b8f61-4673-1841-a2cf-08c071c0145b
  8 e050fbc5-5ec7-080f-993e-ce1398030a98
  9 633215bf-02df-6f9a-a1bd-479489787abd
 10 31388fe1-88c6-1972-94a7-bab98855bbae
 11 2bd3ffcc-9751-3685-8688-9088f9d7b0cb
 12 0ffa3230-d4f4-4ca7-a11a-5ce57fde5a79
 13 c1ebacf3-7c9f-55f6-8724-c11d3ada9999
 14 d383d70b-b6e4-2e00-98a6-4db1a69fb114

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 51877410613452. Exactly this sequence comes out of new Random(976).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 452 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related