201209231402 10clrd

explained decrypted filler

3DES(name+title) ECB, 23 GUIDs, seed 384

Metadata

Post ID: 10clrd
Title: 201209231402 → 2012-09-23 14:02 on A858's clock
Posted (UTC): 2012-09-23 18:02:49
Timezone: UTC−4 · title 14:02 against posted 18:02 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231402) = da35f35f611d58d68d682d134adb4fa7 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(384).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 80 · predicted N = 23 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2661A389C7C0336F 71AEA2A336FB9211 CC9AED9E971BD4EC 36E1DFDE707C581F 9B78FCA44C974354 06A0663FA96159D2 30234232C1D93AC6 F0B6087BE0855D48 37FE729EB826EC34 00196B27C6CC4127 A8D7ADD18F20643A B3261F6F76D9E81B 5C2B77E8D79661BD 51BCFFAE53FCD43C 7DC7468454080645 BB4F3E144FDA38B6 DA6BA8E423494A1E A0D0E02C8D98AEEB 788061A91533AB0B 4CEFFD17A41CE080 87A440186C75ED3B 442BCB859B978D29 A58E7AF68D66C678 5D0D431669871E76 5F81D97FA7FC964D 8E73F18ABD7AA2E5 5D7DBA920D4EBA31 DDB122397CDC0F6E 05CAB6C7EC4764C1 99E300D0EB88C74D E816F35E37E7CCA8 BDFFC79D69393F51 118E1009FDEDD01F 72219D529678D624 C9582D60DD724439 05005BF1F61D7D9A 84EFE6121598B815 B6A660ADB9809C83 6DBCC68333DDD70E 20577F1D5E24697F 2BC5F76E0115F869 0239A0D792ACF53E 58607C98C2E5CCE3 C28CC6D2F1950B7D 5DB32B7F5F5F3424 7738845CE4A54127 8111AD92A94D0777 9390786EA1D8E2BD 4226792FE0A5266C D4BA7B08D18710F6 C91F653508379CED 26DBC3B36B61AF4B F97761D21A199971 9DF4337E57F3DC9C 403B87961E6B9CE9 E51F42B408993C2E 5651EBC454060297 C6F2AB0D587E582F D8BEEE9846465401 8ECA83C22CDB64E9 92B0DACBAEF7FB2A 807B90A9DB1D250C 31E43A4750259F31 7778CD87BA02D0E9 E888B9CBC6BA6728 9C4FFA8C26F9CD15 1F252D18E4A65F66 479EE7771ACDC955 0AAB006B796E0F41 135C956B4772BF68 EC2945CD5F9BFEA8 43983EF2D999D7AB 2169CBF779ED3E71 8AEDF85CED6A3F0D 97B1DEB7932F8EF0 C17D0A947F570F84 A80954B8A34F0793 FCFF01345AEB0BE6 B34985E3005BDB32 34DED8A479B8B318 CED0621F345C09BD E498206F0D385151 BB11866DE192F83A CD492D00CFE3A46D 2BAF82028ACC5235 17BD361665865700 20DB674332BB16DA 61EE450873613F5B B00E856C25B76094 E73FA1863DF06C4B 09E85D90984B31BD E5CF00A370F2A6D2 B6CC1F341985E420

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231402 (name+title). Key = MD5(password) = da35f35f611d58d68d682d134adb4fa7, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2494727f-ba49-3d6a-8735-11ea48535884
  2 8a481928-0032-4117-8008-537379aeefb0
  3 913c9daf-752f-19d1-8f90-052f91b6894b
  4 56155218-9ffd-4821-82cb-9b6f645e3c3b
  5 f2f6a64a-f366-5810-ac4f-4d69059ff19d
  6 302a1460-d89f-1731-b7f2-bad3929ac231
  7 808ddc3e-875b-8460-a1b0-4a0935aa797a
  8 60644b5a-b144-07cf-83eb-5cf5fdb02ead
  9 595d51ba-5a8f-4135-8aa1-66f0d8908d31
 10 c66a6622-672b-7a8d-9adc-902ff5961409
 11 05ac4143-8da0-1a57-8eb1-bc4e04eef6e1
 12 bd56b597-efc5-286a-a008-6de6bdc31788
 13 58ac762c-6e2f-5ce2-af4a-596a94f7d459
 14 e38d0dc5-af60-2b63-b322-5adce830d18c
 15 6c9146c5-6372-65d4-a0eb-984097d95882
 16 beaef9ac-7525-7c3d-b69c-6c5a17c9679e
 17 78457740-c405-2a76-ae41-b77524ded44f
 18 61d1d1d2-8241-076b-8a19-318f195e2e5e
 19 b62687b1-d839-0130-bfc6-730509352d62
 20 60f4c4bf-734b-06ea-b0d4-077a1e69c989
 21 51b6d407-2499-7d63-86df-950ab3a8235d
 22 d91a77a7-278d-0b87-a2ad-999dffae0d03
 23 cb829ccb-7459-81ff-b125-0479d77c5453

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 34145180471252672000708. Exactly this sequence comes out of new Random(384).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 80 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related