201210110500 11av2m

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 799

Metadata

Post ID: 11av2m
Title: 201210110500 → 2012-10-11 05:00 on A858's clock
Posted (UTC): 2012-10-11 09:00:04
Timezone: UTC−4 · title 05:00 against posted 09:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210110500) = 90ebed72c913f13b4891c33057c23d07 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(799).Next(9) ✓ verified
Run: Run 36 (seed 335,015) (seed)
Draw: 3 · predicted N = 15 ✓
Machine boot: 2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 9 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7C358C07C6267A4E EBA7C4837CD61F6C E45F7A93BAE2C038 FB06D50E6CE0F60A 2E76C8B2FEFB64F8 EC82E8CF4A70348F 0A2E4E9BF3CAB9B2 37B011F509E21F73 0F0BD114BD4FA1C8 AFD0A43115582817 54F78B657872AF58 FFCE0E3D753F1D30 83591677A904401E 465EF2B969347C4C 310D1931711342E8 21B32BF6D432A76E C0BF0D260F4DB507 E731B9A57923C2A1 E532F93DABDB73DC 6D2D808AE38AADEF FDF32145E9F976C0 FD49122A9185CF5C 9A41BA84E3836B74 B34D766D40E1D268 DB0B880F23012446 641481AB831081C2 BA50AC0A5CAB4806 EBDF6ED54747B1C4 7793FC26BBAC72E3 9A3C6AA529CE273F 2C5A4A3DD8F409CE B005B47FD0D13D5C 62DADF8A193D7F20 4EAD38F55173F1CF 3EE98E3DCB2CA163 6D50967C69166D4C E27FA98D9A709536 932BC9D0347A7833 332D61A556F8617F A8378CA6854DF684 90F1F34400161F05 CA8896E3BA72690A 5011CA0713AFBB5D F35E71952D8FFDF5 E08A9FCE7B76ABA3 F73A568306FA93EC CC7ABE01F1855DF2 FD64446476A4A338 7376703893ED9EA6 44F583047324E94D 04ED47EA3B1329D3 86149D02E33ACDFB 43DA2F63D3D510C7 79EC5F136B950A89 F79F4961A93CBA9C 9330CF3C993E13F7 193F29F0481DCE25 7663DE34AC10A44D E7283D5288604C3E 8C10A9B3799A4CE1 408165E8E78EC49B

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210110500 (name+title). Key = MD5(password) = 90ebed72c913f13b4891c33057c23d07, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 919f5310-fd59-1e71-9ca3-6cfe91c5adec
  2 7e78dec0-97bd-254a-b050-2fb29b90bd59
  3 3753b2cc-065f-2468-81e4-df635121098d
  4 dc5fcd1f-808f-079c-8024-256bc0f6c976
  5 9379282d-ac22-8b28-953b-cc080a9d50f2
  6 7beaadbe-18de-773b-bbdd-283fcc0a1f9f
  7 a80d73e9-33a5-872a-82da-2d53aa2df3cd
  8 62ee95ed-fa0d-2f76-b8e7-7a44d8a5d996
  9 34cc065a-0546-7275-8da6-87799717995b
 10 c3fb7c6d-e17d-838b-a157-596d9c3cb747
 11 e4be629c-58b2-8c01-813a-4e5359f1d22d
 12 3b511fcb-d9f8-227f-ab37-8e327ab26573
 13 33333842-176f-8af7-ba33-1534ee2ecf6f
 14 18238e07-5966-1fe9-970a-bac6c590983b
 15 9cb55d08-ec8b-2656-a689-1289cb8bee72

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 122087827882812. Exactly this sequence comes out of new Random(799).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 3 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related