201209231320 10cjhr

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 690

Metadata

Post ID: 10cjhr
Title: 201209231320 → 2012-09-23 13:20 on A858's clock
Posted (UTC): 2012-09-23 17:20:21
Timezone: UTC−4 · title 13:20 against posted 17:20 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231320) = 95f558e1ec6760336fded1bce39f9d34 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(690).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 38 · predicted N = 21 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F49638E073E584F2 37F5C5F3A49C4653 6AC3EC70CD3ABA7F 53E117AF45860844 368CB44358D52AD0 9FB0A7DBE7F48C60 9C0501B4F4AEA2F9 FF36969F47FE9467 AA6194233FDD89B3 4EC1C06BDE686940 D3BF1C37CEFCFA1E 040177BB4D823579 332B4D9EA6B0114D E7997E03F7F34818 3708ED898FF74292 809D63180AA26536 E084BDFE1BF7B26F 57F1A5EB6377DABE 90C747225F076925 56B5BB6E7FD3D264 BB24FBE7EC8C2D8C 62FEF106B9F113E1 CABB08E806969161 7A04552D321D2750 0F73112C17ECC0F9 83DDC87F2CAB647B FA7C94833E999604 369294311F48F959 C902A0261F10D2CA BBD9B34B8DC19A77 72E8378CF3B0BBED B119889527DEB132 D390DBD782A8EE60 915D07F93FB26D5D 2C2EC30BC0469281 F4128BFFCF59753C 4CADD0E3E96AA333 3E15A95A40EFB74C 03B6A5BB646C9EC4 B3C9D83BC542D38B 5DAE9E87B55AA5CC 8AA28BB380FA4F5E 971F33C90EB792B3 BE0C0DC10F7AAECF 61214814FBCC780F 1828980EFE1475A2 829EDEFCBA2FC3AF 5A16BD0571F75E9A 54139312E800FB2D 20BE0402885C08F1 08F0178308DA4A7E 3BCEAA09AC9B60EF FD2242FDB4EDC9C5 C7AC74AE38E2C4F7 0DB15044C22A63DE DA06AA6B65529C88 4B91BA5059CC61AC A04511E80AA8AA1C 74E4B4302272FFD3 EE80B16D4EDAB9E8 E334BD0C46A1D3F5 4D8A25F07E657779 7D33347BD91CF1EB 79FD3F3A257DB1EB F192118B488254E7 63831604022B4755 5819AC64FA360F8E B094AE3838DECDBF A6EA780D97DA9A0C 30FF992F8BE53EE8 19CCB3647797A310 CA91C0D690109619 85606EA4BDED3267 27ED1B4DE9C82331 A04677143075B83D 21A4F4078F3B4DB3 6718AE2ECA72646E 25DBA05B69AB5C10 6687353BB8BD92E6 494BC2D3AFFB5A09 37FF620B2FB65DB4 9BD5A7D6288C2C35 0F452E8E71883749 2F11BE061707C167 75851DA0F1A92374

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231320 (name+title). Key = MD5(password) = 95f558e1ec6760336fded1bce39f9d34, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cf74a6cb-8279-185c-a042-f8ac72d09715
  2 ae387ac2-cbd5-2bac-aa21-4dcd62c61abb
  3 64bc3277-287e-055a-832e-b1ffa32040c9
  4 523a085f-b23e-7bbe-a1e9-7f17f4eb5daa
  5 02ccad4b-6639-6743-8fb7-37b5f7a886f8
  6 44d017f3-a813-4a8c-a032-3a1df15adde7
  7 5557f2c9-810e-0f2d-84a5-5e530bd99f08
  8 b2da0f85-359b-5415-9fe8-b9c3a14a08a2
  9 a365e7c5-6ec1-3d83-801d-21283dbd640b
 10 696ac847-d749-611b-83d0-20e10e726cf5
 11 4ea9717e-9b1a-5b7e-a543-dca1dbdca4d0
 12 a3e71bbf-6df6-127a-acbc-532ddcca8e18
 13 a6123059-5242-8865-8c02-17d7505ecda4
 14 d6e73762-40a0-4fd6-a977-551b11da151e
 15 a8884eed-35ac-87a9-a1c3-e71bd50a59cb
 16 5585de1a-6560-8d43-8c7d-fe54c06fe30c
 17 4ea91400-5c05-80b3-b16a-3f6337dd27cf
 18 cef2f625-e236-777b-b5b2-bc3a7828f5cf
 19 4524dcd4-4b8e-3af6-bf7b-112b2b98d793
 20 716ea4be-de16-4ff8-b0a7-b6914e1a0f60
 21 f19b2ca3-c5ee-44b0-991c-8ddee16536d9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 120764053651848887344. Exactly this sequence comes out of new Random(690).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 38 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related