201210091900 116tlk

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 504

Metadata

Post ID: 116tlk
Title: 201210091900 → 2012-10-09 19:00 on A858's clock
Posted (UTC): 2012-10-09 10:00:05
Timezone: UTC+9 · title 19:00 against posted 10:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210091900) = b35b12c440da25b713dc89fc73626f68 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(504).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 500 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5CB5607EC61A7F8B 4EF0472B4A828C97 F941793338F3856A 6EDA485F5296A9D4 400B84DECAB9B9B3 39A688459DAEB0CD 057F57BD3A2F984C 6FB7C2011A5D8AA7 E399D1A7831DE475 F63E804114CEB2A9 9A4029C3B572978E 5BDD4A21C49EB9DA 569A5D83AF5C4D69 9E91B414CB290A09 974F2FA37B4907D6 E404ADDD0F08B97C AB250EABCB7CE746 3C89622C03E2CE25 9BF2D12E09911A62 55360417750947E9 12346691B838195D 11243A2B9BDA4877 60B043066198E49B 68C9249668CA3BF7 BB356A60413F51E2 9AF08C94F28E6BDE 4928B8AE11825DA6 2C17AD4DCCFBA63D 2297CC14703066E7 14FFB3CB7F0CE35F 486C08FA69DBAE27 E71546849F1CB7DB 8E91187CE3B58B83 03C64ECC4FD9E1F2 3EE4BE9D25DE0427 CA2DF3E894F63DFE 53216E98DB309760 50125468D5A45916 62BEB05BE3A76F91 4A8669E371CF4785 01AFACB82EF3951E D1CA413BDBA1E12D F0243414A0041437 AB4138D76536B293 4AEC0534DADBE638 59E9466330C9F76F 56F2B4D5E7186778 BBC788F5B48AC1EE 086A30D8EDF6FA5E B65199DAC1036270 639603EF0CFE1A35 6A9C9FF71F90DA2F 78CE279DA4231B48 46C0966E212DB5BA 27FD3C9AB5390A4E A51ADAE3692BBAE2 3021257AEBE3E88C 4F0FB4276E385CE2 EC6391AA97ED60A6 5861B76C7F589822 DC4B4D38CC0E2A4E

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210091900 (name+title). Key = MD5(password) = b35b12c440da25b713dc89fc73626f68, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5f8c7055-08dd-0c09-8638-9dd7104e242a
  2 cce66838-88ee-6fff-ae93-a4e591b81af4
  3 ceec2cd0-ee81-0d87-861a-b697eb902d79
  4 32375275-b5a5-15d7-9927-fbd28b1c4fb0
  5 acd383c4-db17-68e6-a59e-8063c81941e3
  6 3f3791f0-3ea8-0015-9b54-b5518610d7f6
  7 2ab14b3d-1db3-67e8-9157-d35107f3e698
  8 5d405324-a6bf-211a-bbfb-eb1f07e5b078
  9 76c51b50-8e2a-2cd0-ab59-d5025286d80d
 10 f05a3b9d-cbae-1969-952b-6bfe76317709
 11 b4775e47-c83f-5bd6-9c4e-04335079a67f
 12 ec70944e-1e9c-8f60-af60-9e18bd592e7e
 13 38619b7b-b56d-06d2-9e43-f2a6b4632b46
 14 8d53d0c7-906e-6397-9e3e-0689dea6c6dd
 15 ea0bb897-6e1d-685b-9dab-c55da0eab9c5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 060160622158066. Exactly this sequence comes out of new Random(504).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 500 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related