201210141300 11gsn8

explained decrypted filler

seed 558

Metadata

Post ID: 11gsn8
Title: 201210141300 → 2012-10-14 13:00 on A858's clock
Posted (UTC): 2012-10-14 17:00:20
Timezone: UTC−4 · title 13:00 against posted 17:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210141300) = a51141af4a9ff454c8b6b725d6f2a166 (name+title)
GUIDs: 15
Filler GUID seed: new Random(558).Next(9) ✓ verified
Run: Run 36 (seed 335,015) (seed)
Draw: 23 · predicted N = 15 ✓
Machine boot: 2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 24 · 24
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

459C8A2D03C556A2 03DC0C43A431788D 33FF6D73368C3E4F 3D34F1DFA24D3923 39819B7B0530B14C 34B1425C6C2D497C E5744A747EEF9EDB EDE7D00C5FA92C60 FE399FBFD3D0628A 2A4C08A7D99DAC90 686EA03F38000ADF 7821478A6FC96B5C BC1FE2D2216B1C87 5A5F4FDFCD82716E 9E1CC0398932C443 392375DCA9CBFBBB 419C519134AF0EDE C3958979435908AE 1BC70021B959F459 877A393D2EF1C990 FF005017E13B026E 32456A097FDC0E2F CD38AF5C54FF08B4 9AEBBBB9728D4F78 D06A5CDEDE9782AF 484A312D15FB2EEE 08288B4445F888BF CD49529E2CA93C57 4F0FB23CD1519BA0 F9D3E53FA992EBCE C4AA3A9AF9383C6E 1051CF4000182D71 2F597F99CD14DAA1 4C491CE229B14931 9CC52B74300CE61E 1DABE1BBEB2C2BD5 1B55B33328B42149 7B99E14B1671C044 4A595722A1852059 CCDF23E011AD2310 446D4BF12683F780 92BE9286D8D9B818 550DD78AD9866035 06E6A20E9DE432DC C937FA282C1DF868 752EDFB3F070111F 617D9E043DEFD972 4FA724311A41F25B 4D895CC7F6C67DCB 223738F715D348F0 0334EA7DC5CB1B4E 697AE4066DAAB588 5C82D4372E26A926 7D6F1C3FE7F744CD B6C07F8433DB5623 753F74262A915FD8 13EA8B543B8B9676 B66EE6D21AA056C8 CECCFC7FDF8DE7C9 C39E8951A8D64B6D FF7A46EA5D47256C

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210141300 (name+title). Key = MD5(password) = a51141af4a9ff454c8b6b725d6f2a166, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 77c3a2f5-9d68-2c46-8a80-f0c11405333f
  2 87153d17-bbad-4c80-b8e0-4c15522c3567
  3 fb1bb817-a95a-792a-8fb4-12e1241cb671
  4 c1a2c24b-1d2a-57df-b19c-9c1b29e3cf4f
  5 25e06fcb-d10d-1dae-a932-dea1eca43a3c
  6 4c2e70c0-72da-15dd-808a-1a118c145db0
  7 867fab22-2fff-8e63-a046-5ff0525193af
  8 6437e507-7743-3774-8979-3e12410a9dc6
  9 f33dd018-84fc-0d96-929b-34c2dd42e919
 10 56497ec9-b3af-0314-8c6e-523062e810e2
 11 af96dea6-9ebb-3bb5-b116-3ae74d660058
 12 c9d60288-111e-0f64-bcf6-a0b0055a3c95
 13 1af314f0-f903-2757-a63d-da2e7f712d49
 14 ab445926-0120-6f14-9325-9809dce067db
 15 b3ad2740-af3c-5ae3-87aa-3461e8c41e5f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 247511830030265. Exactly this sequence comes out of new Random(558).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 23 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related