201210260133 124031

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 11

Metadata

Post ID: 124031
Title: 201210260133 → 2012-10-26 01:33 on A858's clock
Posted (UTC): 2012-10-26 05:33:45
Timezone: UTC−4 · title 01:33 against posted 05:33 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260133) = 683dcbe8bec8758afe58ec12bef0a853 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(11).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 60 · predicted N = 14 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

14EE0C4B246DA369 CB3BBC4102035EF3 F8CB5F9AAEF09311 4EFFA1B2C8D3DCA1 4BDB8F53B7B44BDC 800774A54182F4DC 3E9ECAAE68A88154 F9B8E00BAE708C07 8D2989F5966BF68D 7F2C65A7591F6328 28533620CEA9B91D 276595DB1C81EBF1 DCF128D77E7CBCA9 6DB6FC70FE69E318 6944FECDC487C09B D20ECA4C7200DD79 78A55F038FC759D3 1E81640B7854262C 9B0FE9A22F98C7B1 0A380E07FF6E1480 95B17E0DB3F54773 1999AED6EF97D9E1 A7DA1A31E2F7B33B 5491D272A272C2E1 D30487AEE26C55D7 A02559A982E37448 246697F1C11EDFEE B60BDF6648CA82F3 F9720E622594F5C0 C98A497AE7324152 C29BC392E3EC84E1 FB436347B626A433 9A948C5E90A79BB4 A8A929CDBDCB8EE2 D9B172308A62384C 236FF964EC810024 91BADBA360D75C00 7F4FF82B66D4E65A F23C8E2970B9E640 626C2EC3AB7C6658 42F20B923EB27224 8187B269683F42E8 692226703799AAE0 3F033D43435F957F C7B59F14DE21F90C 96018B4E3AD17879 5873FE404C90B1E9 778668E28D1F0A1F E555D3B6EAF49B3B 4B324A1A3481121B 73E9E61C6AC3291D 494D9B3C29BDF32A CF6F590588E6C347 BC359778E88FA947 5D0B0B86D19CDE7C 692E5A3D2C9503E7 C946BFB928D985A5

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260133 (name+title). Key = MD5(password) = 683dcbe8bec8758afe58ec12bef0a853, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 03c39741-babd-4837-87df-77284bc0ecf1
  2 d2f24335-1a6b-014c-8b85-c7ae95903326
  3 f08ba714-8770-49f6-937e-056386ad0125
  4 7649cd3a-fb6c-827b-9728-3f9829d8f48b
  5 145a0f6e-3611-14ff-a1fc-8158b4dc757a
  6 2fea58ad-86f4-12ca-b08e-4d16863440ea
  7 ecdd75e5-0a5f-7a01-8e4f-45b4c00769f2
  8 d03afa10-4aff-8797-b909-64fd610e9e66
  9 5edf9396-05cd-3c93-884b-024bb0663af2
 10 2a1bed1b-a79c-2e9a-91a5-71121123e736
 11 d6707f33-659f-3af0-9804-5e0f2ccef285
 12 2bfbc1c0-c45d-06d3-afa9-ae7c641feb0d
 13 7fee3fd1-8f86-13ed-9f99-fb2404f27316
 14 ceda3b7e-b661-10ca-81ed-5575ec092844

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 40481178323011. Exactly this sequence comes out of new Random(11).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 60 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related