201209231425 10cmyu

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 93

Metadata

Post ID: 10cmyu
Title: 201209231425 → 2012-09-23 14:25 on A858's clock
Posted (UTC): 2012-09-23 18:25:04
Timezone: UTC−4 · title 14:25 against posted 18:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231425) = 905bb9542a7df47354b676c121044cc7 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(93).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 102 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1E548FDF3790A6EA 7AECFBD2B5AFB4F6 799F5466B4775634 F74B1A4FEE2E73DB 7C3828413B6EB7BF B612B4237F198E38 CDB4EF7D6DFEF512 8AA5C2E0F4BBCDC0 6A8D6F78E87D66F4 6ACCFFF4F9925466 EDD4C965735897C3 97D6AC60157601C5 98FEFAEA5028B5B7 A4C02A6B593F439E 9EB46678E21E72C2 88341E1F36DB7FC4 6144BBDF6ED29C17 7EAB9571008C0DD2 DD188AC104B3C30D A622C35E57D09EA7 7FDE36EBFA801B11 DE9E71DC270E4A5D 5FEBFC84EFD53A23 71D007A9AAE2E7FE 24B77394AB66EBD6 30D34632EF695BD5 703420607C6960E2 6B0296DF61F387A6 9E59762533857503 55BF526448CC57B5 39D8F77C07D803BB A9044D6B2A34EE89 B3D16C192C0AD845 EF5D470C055D1577 D359C3D206E34443 53C117730AC75E9D 4B69C7BC7DE0126C BF205D8903283100 D418AB65F1BD14A7 CCF4695620486D96 2C812BD8B9115F4A A4F34B44BF322553 A679D7DA68B6DD41 AB38821C33E98A5A 6EFDA8D2D48C3286 C1B12440B0D059E7 27036A3F5E83D6F5 E980695410978177 0ADE3621840EB49F 6AE2C3698753F276 9BE99E27169D64CD 7328D742520C6D49 DCB2701380D6146E CAC3E430496BE4F3 07BA782BA93CCA1D 2B8FB37D9F06919C 4C4C3E6A25CCA6D1 A4072CE48FC1ED5E 051AEF1621158404 1C7BA0428B5BD720 8001DA1C9B3C5D0D 178F5106D7EA589F C909EC17859AF31B 4A9E85CF787E90B6 CA01411D580F862D 1E6C71BD03A1FB56 8195732D31B52646 1E7C4E3EA345D409 88F6397C7FE168DE DFFB1ADFCD434167 0BBE956E8E047F8A 2AF9F283CBAB5FC5 808632DCBECC062B

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231425 (name+title). Key = MD5(password) = 905bb9542a7df47354b676c121044cc7, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d5ea6c28-f27d-22c2-884a-846d04660c15
  2 b49e2e7b-98c9-0791-9f24-661759424046
  3 594106a1-9ede-6b12-91b7-2ba01499d497
  4 e53663c3-6a72-3507-9692-3050743b68bd
  5 c081221e-828e-1f4a-9cc3-eacfb3fa42e8
  6 add90aa6-20c8-7dae-ac75-7d815ea22c38
  7 78a63f20-fde9-5656-848e-b71b354bacae
  8 f9000863-d4d6-045f-815e-9a51b4b7b639
  9 ef24a4a8-7a5d-4180-bc19-3e2fef270c24
 10 58198f27-b8e1-570b-ba27-355dea4e7038
 11 739b343c-255d-7783-9994-162600333bf2
 12 02f4f5b8-8bc7-0377-9fe3-d11d0c3c1994
 13 82765b82-cf03-5302-ade5-865869651633
 14 01061ce5-d56c-7bd9-9d7b-fa528d751c08
 15 e89f0935-38d9-091a-96eb-5717303736fe
 16 37625999-d606-056e-9fc0-730fa1563bc6
 17 a7d62495-3416-863c-b877-a09c2f52ee25
 18 65a60a1b-5b63-5a90-86b0-8e8e79928158

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 206317504570570085. Exactly this sequence comes out of new Random(93).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 102 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related