201210082106 11655h

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 658

Metadata

Post ID: 11655h
Title: 201210082106 → 2012-10-08 21:06 on A858's clock
Posted (UTC): 2012-10-09 01:06:37
Timezone: UTC−4 · title 21:06 against posted 01:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210082106) = 99f0b866f060a971cbe17e8c893d0006 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(658).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 483 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FF59BEBAEFA68879 F75E2775EF78D11B 52ED3ED78E09770A A6A2D44AB98E2323 64CB34016030FDD3 83CB20C2C2849A85 A53CA0AAC92E337B A5F023E4397EE1D9 F80FACBF6B8DDE71 C9D4CE6416FA394C 0FCDB582370F1154 91026D494D882F3E F8155258B716C577 1428638831268685 5128F8DF08072B23 2C77C82710B5C2FA DF32CA97C63338BE DB2B1E3F7F5B3727 04FC0042D0820FF9 E7E21DE49E6D33C9 0F319AB122C99D88 3F0208EE55BBA929 6F122699DF18230D 777384368C8880B2 6E3F338DF266837F 03D4DEB5FEC645DE 07E4A7E5282A72F0 7B3274284E416A77 42B17F9EF0C0D07B 614992AFF9144A6D 053DFFEB170F66C0 4B08452979188CC2 8CDD5718E359EE5F 521B5847AEEC0D66 7541F2B047B391BB A0C5A9707DBC2135 380ED35EEB8401A2 3AFE951E9867692F 198611C6099996C8 20B6E3C473203958 2621593BD33C65BA 68188220C3C4ABFE 3745AC17BF5F72F8 40EB94FB7E496503 56F2591EFAAF0BB4 0C935BA733A89A0A 48CFEFEC752F963B A7D8ACF86E3F5322 EBECF5136BB38A13 70AC102B58B3A6D3 9962756F0DB96415 84AB6E0B4720B588 8B7DD3C9FE9BE4FB B93FE565524D652C E50019831757B9CB 1701E6F7BCEE6EE8 A2C9C55EB3626F7C C2569D6026D780EC B1522541E7E59E2C AF6BE42C0E48DC23 587E463A66D1A007 5F4004289B5345C4 9858873E5BAF6D54 D73B5B55DD54BAD7 314CD5953ADF271E DFE952D2561392CB 8349AF4637E4182B 08D5DB5B864CFECB AD58DDFE11E2A68B

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210082106 (name+title). Key = MD5(password) = 99f0b866f060a971cbe17e8c893d0006, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 50258917-64c7-42ce-9c40-3b0b5aa0fdc8
  2 f58a59d7-6f69-7663-8ac7-9972694c38a1
  3 3f049932-fa18-6ee3-9cda-76bd61fdcec7
  4 5c0ba533-0f25-0858-a48e-d1e14dceb394
  5 bca2e2aa-4485-2f6a-9a71-5353187e4da5
  6 cb911ffa-e97a-5807-bc21-60753d8a84c6
  7 a8f168ca-fcef-6ed8-81c9-9dac08ca829d
  8 013c42ed-fd92-4041-b629-c7be52360266
  9 cd3f2e84-508c-33b5-8e2c-05fcb8d698f1
 10 1354edb0-e49e-8529-b3c0-48f096bc54a4
 11 5067d60e-1fb3-0198-8492-50b124bc04db
 12 fead904f-cbd6-119c-bfc3-bddefe86e5bd
 13 7f084baf-3c9b-863c-98d3-62760c7f1b1f
 14 fbdb7b82-69ba-7c2c-a388-046a615a9558
 15 5d0a1b2b-86fd-505f-8194-c3a709ebd7d7
 16 f006e6dd-12f7-8b15-8064-47316d8b2171
 17 ac4e88c7-f973-4bba-9c4b-cb91555bf9bc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 47602564380187584. Exactly this sequence comes out of new Random(658).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 483 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related