201210231422 11yikr

explained decrypted filler

seed 499

Metadata

Post ID: 11yikr
Title: 201210231422 → 2012-10-23 14:22 on A858's clock
Posted (UTC): 2012-10-23 18:23:00
Timezone: UTC−4 · title 14:22 against posted 18:23 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210231422) = eb1ce7fb4dd64aadd451ffad081b2daa (name+title)
GUIDs: 18
Filler GUID seed: new Random(499).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 1 · predicted N = 18 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 16 · 2
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9F651F8ED30A6801 8C7ABA2818BD2E22 8C178721D32FEAC5 61D7204FC818ADE1 94C0C2C312E727DA EE8E159FF352B1FD E52B1881FC5D32E7 0CF22F67B0A45C06 5E012207B14A23E3 663786D656DD457D 34B76E6BB9C4871A 35DC42B33F760A98 3E8054A1FB8EE409 2CA5043E0F99CE65 77C08A735D0AE959 CB8109A4EF83F215 303F83080226B121 B8C960B89F87439D 5CD5BCED7FB319FF 818817685AB2907F B383D5FA5BC5EF1E 2A9B836F5C6829B8 E0212EAE95BD907D 5A10E6FBAC83825B 09A6DD6BB6E441FC D12613387B647B66 7A3F605E97EF5701 A0C054D9DE6CEFC4 AD106C720D4947FB AAFDAD005ABAF75D C677EE5D53979F74 A7D4DE4D21AD9B0B 22B7C9E87D44FFF0 3BFAD752DDD6B649 4B898BA7048822AB 929D8F45BF1AB556 33562E1509BA4647 A1537D89CDC4FC0A F431238DC17E6FB6 AB03F3D1EAB935E0 E37A0BAA8C69BC4D B114E08F994702C5 C9189EBF3FDEAC64 726CFB2020A4CF60 FBE907E7041D705D 76E621DB40DFE0F1 98531D8D63D3C14A 92315CF2C4FF9023 1A6FF4C8BD66E05D D901669BCAD31FD9 B0409E61B8B3D4D9 4774CC2F1D4B0F4F CD19477C20D47848 771E2AC2290EF00A D00EFB0C5B2B11D7 12CA01B58D22D01E EFD0A4ECA408F03C 5B015F4C5EA21F18 2E187CFCDEC2C12C FF2983563B9C974C 2B39030D1F152ACF A24B68C170C9F131 B94A045B994D3289 B991F6B1205788DF B737EBFC265DB2E4 BD6D7A8734561720 9EF7C77C0C58B662 9FFFE2483C8C3666 5A047870052246D5 17D9B1639084857B 18A67F568597EB29 AA45960D2D7E5839 CD7268A2F70EE478

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210231422 (name+title). Key = MD5(password) = eb1ce7fb4dd64aadd451ffad081b2daa, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 99fdfdba-d869-3389-b4d3-e2955dbf6a79
  2 785a4d0e-836c-2da3-ad9c-a51c058f5730
  3 6ed13300-c2af-5d23-9a66-31c3ca37e89c
  4 313ac2a6-28b5-0896-be46-2af3c3a5865f
  5 04251312-8cd7-4775-8487-8970c115827d
  6 5d96ad14-2300-50a6-a36a-c4e570b8898c
  7 b82d8b4b-01cd-4616-92df-b66e559ea2ce
  8 43c4b62e-23b5-777d-9064-ce2ab42a79a5
  9 781a9e4c-5d0d-66fc-b2e5-ddce013f68a1
 10 04fe13be-a7e1-2494-b8f0-d1d24f6b68ae
 11 b5825c75-77d6-8064-8ce0-572b1ef98d2a
 12 4db693b6-33f2-071a-8e6a-d6b4ef13b067
 13 b60a4375-86a8-6bd3-9ba5-d5ee41c889ef
 14 94ceb606-ecb4-025b-a353-12c9f8fc5145
 15 ee33a010-c7fc-2b04-a05b-02131c15862f
 16 c1a16197-61af-58ee-b42d-251c0d45c743
 17 12119b1c-5443-52b8-a283-d1dae2152842
 18 8146f5e9-a4e7-3a80-9913-6549b3668c68

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 325045476280602553. Exactly this sequence comes out of new Random(499).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related