201209231308 10citg

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 958

Metadata

Post ID: 10citg
Title: 201209231308 → 2012-09-23 13:08 on A858's clock
Posted (UTC): 2012-09-23 17:08:10
Timezone: UTC−4 · title 13:08 against posted 17:08 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231308) = 5ca1714c9e3f9a402277bda44371f431 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(958).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 26 · predicted N = 21 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F46526C6B7963385 CDCBC85F88BBB618 0A25E97AEA3D5234 CECA0FAB37983648 A1867D2A8CC4EA3C E681488D820CA741 8320EA9127842D98 AAA99FBFAD3AC445 CC6E259F7B0C8980 4EA621D59AE52861 0412BF4F79F9C7AE FCD586B89AEF3D94 5A8D52242DDE3DCB FC7A2E19FA420356 A9530285808DDE0D FF75C427AD35F076 5B752DDA57A4E61D 99BBBA24499B23CB 5D45DD3E4E7333F4 78852ABC24BE51F8 A8817A5B766FBBE7 E75AD22BE7F9A382 84113B226610D423 7FA753653C387500 701169C0BB665D52 E9D13BC63BAA5B84 AD8D7E37ACE40982 64CA352662819B02 D36C24EA3FA2131B E26DF2DE5C6D5299 202FDB55BEB76334 8F096C6CE70EB592 F859B199835BF80F D349EC2509A6F26B 9639DBA585D0D18A 34DDA0259DA24CDD 1355DED72EA08B82 70CF223C1C672EE1 699D2055E0C34B14 3EDA8CF26F039BC2 311C892E919A224F C8E24DE546EB45E8 B5D5255B8DCC5F8A 823CFEE229D32CF1 7E8B44B8B99928AB 4200F5481ACC4E94 0F84AAA7EF9B2CDF D042CB396F9F7DAF 5EB8987642D73E69 E6D0E67C35E619F3 ACE5203B28E8F129 55E10AF79DFBEF27 F5B5000E00F093D8 B83009B440100630 9A5EE8B73E604243 3EF0114FF9723571 9940D0E34572A91A 2A7F6F79B3300F4B D7C08B4F7A08E21D 653C679BFEC52FA1 48C1B9515F082E2C 7E9E4D6B013FEFC8 C0363CE53E658000 5EF06368C37C8769 3F2867BE1E559455 18B2025564ECA058 E98F6FC6A4ACC121 3B0CB54253F69D3C 2E1F0C0D3B1F0689 0CE234C072DBD234 926802B061C95A25 A56162316EDC9A5D 8372C095B48688CE 91DC98BFCDB8BBD9 984122DF78A6DE19 4B086E9D0C0E3B06 01B5C353F16C4BA2 E37E79402DDD0109 CA5DD38639887E4E 425D26881853F146 C70801932827DE0A 59CEE4C295CBF7EA 6FF5FE186264AA85 3E2DAA363FF03264 48883C178669CFA0

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231308 (name+title). Key = MD5(password) = 5ca1714c9e3f9a402277bda44371f431, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e574ad68-dbef-1a89-b9b4-3812e0174862
  2 0c1d99f4-4d42-898f-856c-cf513d98e646
  3 85ca7f53-127e-32d1-915e-e9b3e48a6cf4
  4 8327517d-78bc-03c3-a073-11f0ad53e122
  5 9716706f-6e4a-6323-81ca-67188d0420c9
  6 e2806d6a-7b44-6480-91af-0dbf15c4d3c5
  7 ea4d28bb-ff93-146c-a502-077ae241827f
  8 a20f1708-fcff-092a-bde7-8adac0db6ec0
  9 588e2b80-6b15-42cc-9ecd-a41541eb3276
 10 ad0c88db-b2bf-4994-9e5b-71c8309889d7
 11 0faf0d73-4210-0850-848b-bb3b80c2c934
 12 be60a9a2-b4ca-370d-a43c-960b08c57f65
 13 454c8a88-ba61-173f-b239-0932f4a3f98d
 14 59a8e3f6-2312-708f-a154-cc9e407027e2
 15 dce59e7b-93bf-4520-8e8e-677d9037f394
 16 8f0cb8f4-ac95-28b6-b018-008013c19ad1
 17 22cd94f1-d667-5120-bfbf-66844eefc005
 18 1a3f44e2-e754-895c-ac58-49331f8622f9
 19 72962c2a-9418-50e3-9db8-029d990f5e45
 20 4ef0f883-c9ba-27d3-96d8-bcd54f0927bf
 21 9b7caa23-88dc-014a-8452-9b92d886000f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 183066104403174258520. Exactly this sequence comes out of new Random(958).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 26 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related