201210140900 11gix5

explained decrypted filler

seed 818

Metadata

Post ID: 11gix5
Title: 201210140900 → 2012-10-14 09:00 on A858's clock
Posted (UTC): 2012-10-14 13:00:19
Timezone: UTC−4 · title 09:00 against posted 13:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,232 hex characters · 616 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210140900) = 7183e744804fa2d654519d4530914f70 (name+title)
GUIDs: 19
Filler GUID seed: new Random(818).Next(9) ✓ verified
Run: Run 36 (seed 335,015) (seed)
Draw: 22 · predicted N = 19 ✓
Machine boot: 2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

EA98869559AD820B FF18E3EC66C2D368 14921541BEF6CFAD 75478743E30400F9 0C9E9C03BD8D171C CC5826F578997A8C 4EF6BC8F5EA3CEA3 1FE9018D52CB8957 FF3CBFF42DA71188 27F42A5E20C319AB 0136BBEDC35F157B 9808D17E113C2F18 015E8E0A89861413 399BC1EA096DDD5E 343590381A2BFEA3 83AF5C31FB5CF7EB 940F61FEC8932F12 DE8B6A3ACAC76247 9E3DF90BED48BF45 8BE79E24325AC45A 7BC308153C421942 BD5CE0613B9377F2 56A5DE4E784B1C08 30A5518EBB0D828E DD92CA635F9A198E F0BCAA72C1ACAC68 998236497C739625 E3CF1069BE495DB8 37AD20EBA0E4F1B4 9749D59D89CC712C 2AD345A373FED1EB BF4658B5C73BC21B 46410EEB0AA2A5D7 BAA2E1FBFAA3174F 93F2D53847128782 428D6F4C359FDA41 DB5EFFFC2E07DD8E A4DA4A94677572C3 412A94EBB73F8FED 24785F7119C0125B 819BF6CB5EC894D7 42842283E3E490B7 44775C9FD5C5CCAF 0EBA0728622B702A 2E68F4419B9C4FB6 30302E7FF757A771 977A16E76BBE6831 DA0B22E4A4A394C0 FB10D2E1C2F885DD 52ED13D9E928307D ADBCD3738E34F81F FC0A6F63654730F8 5C7E2FCE6DCBC052 0BF6D512FBA03412 19F9A4847FD47618 06BCA5FA62CC8DF7 5A289703A0E81372 307B35E9A9BE939B CD7F2E1751C22E18 C013642C68AF92B4 094AD03ABB928C6B 1AFE82C6ACAB3D76 77E7695070EDFB43 A2DCB31FDE37F0D3 E62F47EED568655A 70308C40F5615902 E1DB121600537FBE 819DBE9EBEA3A1A4 2921AC7C85625CF0 B52135A2859F6137 8737913964B93E8E 097BDB78591E74AE 964C55D258154E16 89629C269E70741A 6A969D15C727ACD5 81F1875FF2C7DDC1 F4AA4DA2CAFCA287

Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210140900 (name+title). Key = MD5(password) = 7183e744804fa2d654519d4530914f70, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c19a01ab-b9bc-065f-acf3-73119acfec38
  2 df650036-5366-7624-adf4-cdbdbc83202e
  3 4aa0f0ec-9e42-4fa9-aeb2-e9128f65a773
  4 8ce4fb2e-fb98-1e29-8fb3-1345e2040531
  5 6a653e06-1c38-4098-8a94-482471afd0d3
  6 08629818-24be-39a0-a600-0fa34dcbe0e0
  7 31025101-0735-3f6e-828a-8e0c0db00997
  8 b422c1e4-7c7e-72f3-a728-9264b7a70f90
  9 350b69c5-4df4-1029-93dd-2b303ac5b2de
 10 2305cf95-1374-84aa-ac8e-8cbb2e788d88
 11 10d264a0-4e64-8b6c-89b8-3bb9b6807619
 12 7de8ab65-5617-070c-8f1e-4b1153ba1648
 13 0bd2fefe-104b-8625-952f-b6b7138e46cc
 14 4545a5a9-19c8-0c86-87fd-9c4dc8fe2bbe
 15 ccab89ac-b09b-5118-8b7f-b14deb04ab1f
 16 baf45b7b-ef9f-7b51-a035-6d3302e0eb12
 17 8ed49826-d515-626a-b657-f28fdc48fc91
 18 daacc95f-d48c-17be-927d-73f1916ff556
 19 75fa996f-8a40-742c-892a-5f4dee52624b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0741433718808057617. Exactly this sequence comes out of new Random(818).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 22 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related