201210081206 11558x

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 946

Metadata

Post ID: 11558x
Title: 201210081206 → 2012-10-08 12:06 on A858's clock
Posted (UTC): 2012-10-08 16:06:08
Timezone: UTC−4 · title 12:06 against posted 16:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210081206) = 7292d72b3885e18ae894bdf8aa363754 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(946).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 456 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9AB675D8B92BEE38 B530404D7D224733 B49AE6E00C004383 56B5B9B4B1FD01AC B2DF0DEE6ED290B6 BBA10FA1EF50D6C9 3F1A0702766603BE EBF1355EA1BC5BFD F99196CD59A748A5 5CFD7E301F23C772 6CC829648F5BCEEE 96CA1261781C6578 4D9A3B19D97F4CC3 85CC767FCB128078 610F7A3C3443A5EE 1DCD3C5A511D77CD BB5A99E5A1987188 943BF931077A66E2 71B25A933160D9BB F0622D88297398CA 6AA7D956FC0260FD 92550F865E41AC95 FD2317C870FAA0C9 D283BE80D45A9433 FDDB9E2483519C32 3EA856782521542A 3690CC211A2CA04C 291A523AC60C83B4 CA2D7034835CBB4B DFC9974D6CCF1E2B B09A9DD26CBA6358 6C0E322C524FD199 2084738FEA5FE5DA DFF9B8328B8BD715 F3CEED310DE9974E 774CE1417A976A17 D7C96B4FBAA6A65B BE5444C5228F6D8C 03699D4A904ECA1B DF1F2D07C0962197 F578661E6831D481 826B0C7F28983B9A 0D458B97CB519DD2 70F92DCB8B0D0DB5 DB6710B18FE7EFC5 3FD408CB0DB74CDC 80871E017F883AAE 5C80B172315755D5 F3022F6557EA1662 CE5AE9AC64713C04 52744D9B59AA7E47 2682537CC853C41D D40B8EAE05253DD5 7DB7123F8D6637AA AD7D8882B69D2448 D821605F8B8206C1 458DE447718E772B 998893104708F55A BBC48EB36B50CD10 41FA6A24F8AA9250 1D5007056802D59A

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210081206 (name+title). Key = MD5(password) = 7292d72b3885e18ae894bdf8aa363754, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 209e3282-694d-8e6b-8186-cd9fe7ec796d
  2 2d2d9409-9543-30ff-bb8d-39280de72550
  3 9ccd2ede-987b-0b68-afc3-e0ae42199cf9
  4 39063b38-1760-48cb-a612-a66a901b0c86
  5 c0e5db23-0dbd-2e92-9070-15a03dafae86
  6 78dc40a5-5afe-28fe-bbef-f34250074108
  7 89033770-b006-6d90-9275-5c008424b888
  8 f8f5b1cf-d9c8-0cb7-a4fb-d78ec95e2ead
  9 6fba76d0-d05d-0870-a1f5-22aa774b267d
 10 336f4337-8823-1168-87cb-710959c99f57
 11 1623fdc0-f1e3-29ef-a595-c5d5f11ee1c4
 12 b6d5b6de-d1b2-0e91-b21c-363b9e482da0
 13 e0b92d0c-1fe6-8a80-9e96-7beb028b22be
 14 cef8f280-c197-5c8a-94a2-8d6c6eb7f478
 15 40a7f92c-8382-117d-9b80-07970d893047

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 830422600120851. Exactly this sequence comes out of new Random(946).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 456 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related