201209231351 10cl5x

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 256

Metadata

Post ID: 10cl5x
Title: 201209231351 → 2012-09-23 13:51 on A858's clock
Posted (UTC): 2012-09-23 17:51:42
Timezone: UTC−4 · title 13:51 against posted 17:51 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231351) = 3d06bd318628fa76cd5c05305ad222f4 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(256).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 69 · predicted N = 21 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E2E9D37586395F3D BCF0F81890D57FCA 49EDC164B74B3F62 73C064A14A924578 2A73FCBBE39BF12A 9876815A6EB15FF4 73DADE5E6E6944F4 E9D5440B86C126C0 5DC6B44B745DF504 B075E1D6907DCD92 14CE484E0D4CD48E 871905408B64FE8C 12CCA9091E0AC5F9 3742357C9C57F70F 6B1C46C9101D5FCC 47E70225239AD11D 9DE32D80B43F57A3 5DC270A417ADB3B7 D92D63858F9A4735 D1D08D71800BD280 6A88E32F7AA31248 664D9BDE1AB0F32C 494EF6EAE1B25BED 115098E6C7400077 48F318E76CF7F7CA 39BA09DB1B7D2B4C E4333D5EFF31675C ECF9B46776D166D8 48DDFE4F25644F8F 19A663FF9AE6DEC6 711BE78D6EDCF7F6 430E48463AE37C74 B49E9FD5357E5E8D 19E022A2EF987A5E 31858E186E868339 A9CB770AB3EE1BD6 3CA119F019EA7E9F F0A55FC0C83FD583 1C4A80BFD20370F7 551778C30E1A02FF 723604136009E9CB 0FFDD3CA8E1A00B0 2AB0A98CEE863138 C0E8F8CDB775F785 FB3229DF73E8F41F C2B9F6A5A5E8F500 F0E09B3A2ECDA8BD BF413D9EA0D460CF 8904E01A287AF4AF C6CA6FBB97A6E707 5714F4C6024D31C6 0B5374A4DE820F44 2405D5D5CBA3864F 7D76B1410C9FC633 908F0917CCA268A7 029F70341C082DA6 FC0C5100EE827A29 ED440F4776F960D9 366B5F789008CC35 F97C4D7C5ADC64A5 8A4A6B7ECC15AB09 997FD01C91BCD6EE 2663FBDA8C96D9B9 99A2C2E0E3A6EFA9 F9F75E2C0D3F2048 37B067DB4E5D5A4C 357B5F4E5981246E 677EDED6B481C398 529CF8BE38E43598 701F9680868C5C9A 02964FCE7CFA2587 741D89372B82368B 0E8526035C559C77 BA985DAA857476F0 44A7BB7577B6FBCF 34DAD142F560CC50 A599F085AB8680D4 2702639C8947C1CA 42AB8D8111B4DB00 B70FCB7135537A3F CB6C18BB3DB75701 C4F6E5A6F2C4257D 8E7DDD832DE8150F EDD0DE47FB57F83D FE85B49B637E0F0C

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231351 (name+title). Key = MD5(password) = 3d06bd318628fa76cd5c05305ad222f4, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 65c511df-5979-4c0a-9b84-59b6c31f6e27
  2 3c08b723-ae8b-8c70-ae93-24198af26aa0
  3 0719eff7-e9c5-685e-ab06-a6ec61a961c4
  4 6aa4dd99-ce6f-1b00-b541-9e4ff2dd09b7
  5 181c10f9-71c1-7728-acd6-0577c1e99e28
  6 bd4c03ff-04f7-2df9-9231-6b96147855f0
  7 60554936-32bc-5109-93cd-689a3a068622
  8 e9ab0ce0-582f-7f90-8d67-90b8b04b0b4d
  9 74361966-5950-5fd1-93af-ea9a77858e6f
 10 e17df120-037c-6a0e-942d-5b9f942ecafd
 11 bdcdb3c1-b4a5-8750-afd4-a2ab4f78cd34
 12 7a2d541b-587f-2e71-ae48-08db3f37bac9
 13 b28c6f47-9152-5359-9ca6-516244291946
 14 3cac4db2-47b4-59f1-abf7-91c40432a292
 15 65a7e73c-b958-1863-be8b-5aa46bfdb7bd
 16 b0abb3c9-1643-8a1d-864e-5b3dcc0ef5bb
 17 cd1415b1-8044-4515-934b-862eb2cebc7b
 18 9f8e2f74-ac88-6788-940c-710af1e82c6a
 19 6b9c6400-99d3-5c4a-bae3-068feacec5ab
 20 10f61786-8b40-3789-86a2-21e31e7dbf31
 21 099ad80c-3f08-7f7e-b1e2-64e7f26da10c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 486172575682551846537. Exactly this sequence comes out of new Random(256).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 69 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related