201210082346 116fur

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 861

Metadata

Post ID: 116fur
Title: 201210082346 → 2012-10-08 23:46 on A858's clock
Posted (UTC): 2012-10-09 03:46:45
Timezone: UTC−4 · title 23:46 against posted 03:46 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210082346) = 8709035a8b40e369e6753613b3acefaa (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(861).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 491 · predicted N = 13 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

277AC5692B12AF40 1F820BEAC9FFC1D5 CF1433D793EC5A2A 4419564DD10D09C7 E440D2901C3659C5 2BB7B5653D57F750 626DF088769B8AFB 9E4E915C4252BA0A ECF4565EEA3192D3 1C97B3D44F1342BD A5E3A9148A6245EC D668A56368439138 4C8CA4918688A9B9 ECB28D0524D7A511 49FB6797BB9C8A34 E4D70A11650FD1BD 656062BC9CB25C19 6C91378F8BD5C35C 110FA274AEB22479 412B30D6221903EA 1D3A29783DD7D9D5 D4653BCEF40502DC CC0393D5B631691C CA54735EAAEEF8E2 FB333D2152DE51BF 754000D0CDFA8F4D 860164371907A79E D9B66D150C2F5D6F F88113F558D39048 3CBC02757896B167 866050E42C376D2F A9A5A37E50BBC311 F3D4D881C680A704 BA1B74E869534165 5E42C30AEBE1A27C CFC3135F0495AA46 762DB482FAD5D242 B813F3C054D7325F EE50A9B0691B35F2 AF2E6E099770B924 E65EBB2943CAFC7B 8974F7FFEA402BEF F951ACBD00389FF1 AA445679CBF4691A 1813E692295147BE BD634114CC05F49C 6FF755CB07D6C3DA 3C0CEF3B6A7CCF5A 3860A5440E77242D A2F9593144D94D67 DB63623C0AD6C0E9 3D7EB4639CB6C6E9 8082C7369F6BD543

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210082346 (name+title). Key = MD5(password) = 8709035a8b40e369e6753613b3acefaa, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d6a58d0d-d658-4709-b8e8-956d59138c44
  2 4abf1685-b9bc-4dea-98d8-2009bff01499
  3 91fa8ead-c8b0-5417-a126-070245ebdf5d
  4 4b7b4e9e-5cab-29af-8c57-9008aa13fef8
  5 67affa07-aa52-8e1a-bb28-0281cf1b5709
  6 38e130f6-784f-89fb-9fe1-af511f0eba8f
  7 8ccaf899-1b6e-6bd4-b30f-1b48500d6705
  8 d175f5ed-bdd6-3b96-92c8-e74aa2168158
  9 f3d778d2-9c10-468a-b34b-cb30db170b55
 10 e3b85c0f-a46e-6f05-a3ec-5877309d1e61
 11 e1619ff6-5d05-54b6-833e-3ff6c9a0f41b
 12 ce77e70e-ab84-50b0-b9ca-e076a1cf6b45
 13 aca4d569-9cbf-4771-815c-3c7dcd8f3152

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4452886346554. Exactly this sequence comes out of new Random(861).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 491 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related