201209212250 10a5rj

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 629

Metadata

Post ID: 10a5rj
Title: 201209212250 → 2012-09-21 22:50 on A858's clock
Posted (UTC): 2012-09-22 02:50:10
Timezone: UTC−4 · title 22:50 against posted 02:50 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209212250) = 38961205a30e37479f7421409dcfacd0 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(629).Next(9) ✓ verified
Run: Run 33 (seed 1,220,410,968) (seed)
Draw: 11 · predicted N = 21 ✓
Machine boot: 2012-09-07 21:49–21:59 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9203B98323E2E814 05C9D45E5ACE433D 607EA23D199C10F6 2138BC9648E5A2D7 DD47986C5E2F3CDD A94F83D83191B25E 6B6F18693A0CAC1E 21D72C41AB9D96EC 75B0481F04BAD892 C512CF30182676A5 854DBE03554B8FB1 266C76ED836096B5 9643607566515C77 8B89F525DAFAA9E4 18612CEB28F1A074 95967E8EE1C73D25 3B0BE8E13BA19F55 4F7321247DF746A9 A421D72330BFE3B4 5E43C44B647CF533 749EA248294958E0 D0D65CFBBFC68AC7 C29AA30A1308216D 171A90C5D3F2C7C4 B9EA5760C872C941 D7DD72C856256CE5 1CAFA3E44B582D78 28404A8EAD3F6C64 05C7C2B614090B67 3AA1B1B56E624384 DC0E57D42ABB587D 6DBBDC3E053299BF EF8326AC68CBC4F8 1F592596F5BD43AA B7F79E19BDB700C0 D6B24690763573F2 8A200E12BAE41FD2 8B798D6E187A5F75 A39990B5AE1E53B1 B005A62EFF8FD77D 48A96FC98C9439CA 074C2F63001B9FC7 82567E3FFC9347AF 6CC2CC9FD87FB5C3 E9BD91CA084EB104 5B56C8360CC15487 BE6A1C8500EE65C2 486B604BA90E63AE B590EE1090267EE9 7AFD5872DC442BBD 0AA825DFF14F7CCA 12FBB5643A2ABD36 2B3F591C60970ADE 8C540E0BDDDC1C9A 0872B0E23AB2F592 8ABABD3CD9465A3A 35B8B82514C378BE CF282A4F1D075E9A 76C611DBD4C6B39D E1D1D29938EA6E2E 1335A654A2097363 D63C89D97DE6F0D2 6412488F5C9EF309 835F2BFB537A84A3 B25B8237CAD973BD B299BEC3952048C5 72507EBE91B7DD65 A3E7F34607B60D6D 4F42E82CA08FAC37 504872DEDD0BA4CE 9B36C7531934C54D A0B189F0C50C75C0 C03A9B9BBAC4A3D0 5D31CEC1D1D33B19 A8135D38D9567D21 D5ED77EEA010C200 D2BEE9C4423603A0 2B1AEF96C2671AD2 0608733D25479C59 9BD249F774CFA113 92175B352A52D354 80D488BCC1D2B3DF F6026653E2E9F963 54A5720AD909BA97 69040FD49632A7A1

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209212250 (name+title). Key = MD5(password) = 38961205a30e37479f7421409dcfacd0, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d1da8027-e111-2d60-b0e5-a8725fac0106
  2 82210e41-8a10-3a26-ae47-097915835575
  3 8afe6370-73ad-3d96-a7df-c02e30e9700a
  4 3144e34d-686c-73d8-8eb8-311fe6437aa1
  5 ad63f0bd-8409-19c4-b435-8a9e01ff802f
  6 b801632d-21b9-2fc1-a3fb-226d30bc8ee5
  7 fd15e0d2-b427-6a1e-b2b8-6fa1f1916644
  8 ed36618e-d4b1-0e66-88b9-85ed75d9db73
  9 72e51de3-5265-7304-a618-52aebc282d30
 10 81c4df92-0616-15f4-85b1-aafd0667c77a
 11 8375bebb-97d3-6581-8a48-5c6a2819cf2c
 12 036d76be-fdfa-4d4b-87b0-c8ac8bada3e6
 13 3d892a3f-46d2-0bea-b816-beb681b4e261
 14 92a570a3-ea67-6e76-be80-55bde11466ad
 15 bb63f29d-05ae-2d44-b9a0-cdffa39a105f
 16 df21c1fe-6728-734b-a26a-ffd09ed15891
 17 2f6e3295-ffa4-2d56-8123-0e34cdbee170
 18 57223072-d9c0-8830-802e-2f36378c908f
 19 57ecbe40-934c-67dd-8eb4-ecfe7ddf732b
 20 aa9bef96-17db-7e00-ae3c-ba1b51259b38
 21 d4d50388-2e66-3d3a-bc80-4307c685c624

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 233712607164062728673. Exactly this sequence comes out of new Random(629).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 11 of Run 33 (seed 1,220,410,968): new Random(1220410968), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 21:49–21:59).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related