201209231439 10cnsh

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 884

Metadata

Post ID: 10cnsh
Title: 201209231439 → 2012-09-23 14:39 on A858's clock
Posted (UTC): 2012-09-23 18:39:14
Timezone: UTC−4 · title 14:39 against posted 18:39 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231439) = e0bdfa8b61393f3703bd0f0925677f2c (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(884).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 116 · predicted N = 22 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

000CF125284844EF FA963E1A9D74DE4D 1740F27C0364431C 9CC606019EEB9BC0 D168A6896B96E2B3 D30C2740128538EF 64ADD8A5A66892E3 AFBAF256AC09BEFF 10E2AE93D1277E3A 8B1F36F62B09091A 5395F2AF3014203A 4A5DD42956703862 EDA93BCB30A566A6 2558BF8C0FDDBB76 C854A7D094F52CDC 6D699E64CF6E79C3 21404442BC85113A BB2ED5111AEA4A05 C77B8A43D1F24E70 538EFA42598BB010 113F610C8235D026 01E329C3611BEC42 EFCE08D20EB2748E AF443F1FA34587C4 783E0EF0EC191079 113D6BAC17E228F9 9EE87B77B750A390 FE83A2F8733B876E 7EA203A1131792D0 D356DB68167C6F72 D95A67C4308C6987 A7ED0AFD520E1CEF 00E4325BAC759348 2292A8C6FD245848 873EE919684E32E9 5798602F08170AD1 DED6084EF78ABA54 372792EEEFA1F38E E933280CA58A1361 E22995BB69D652B6 05D5C70B764B367F 2DF5A5E50E984C5A 0F87D308DC7BF61B 62207732D93EDA6B AE0BE441D0A40CB5 9903BCFDB2C6DDC1 8A2737ACE653EF68 A8ECA68CB8C94E34 19198FF2241FD787 9167D67D048CF3D1 6B7979EC2C4F435B 8CB518B53505A0BA 5E5E60829D40C3F7 B585E42A2FBF8A39 96F5E7D4CD18A5CE 3FD27F93FCD5BCFB 1B0AD25C814D1EEF 8E48DA387CC473EB 08C3D4189E03DD97 0C432CF1792FBD97 BE9208967B163AF2 1B97EB5B37339EC6 FDB00B740BDA7E2B 1D33F3437102182C 095CB96B56EE40AC 4D6F4A8919946A65 75E983B75C4251D3 0CEB5EDF3B120FAB 5144769250988C63 148B7E28FBACBFFB 3E8A6B31D42641D6 27203665028A6496 CE677F91DEB83B80 7AB9A1107DD5BAE1 046ABE55C370C6EC 81AAFF8EF65A1CA3 1CAE4737779FD6A8 8EFC8C202BC1DB27 D7AE43DAF436BBD2 FC3AEAE7A99A1F39 97756AD59D6FE705 BCC5FC8C91A40B32 D7BD68F1ACAEFCDF 2971A8233291E1B6 695A8EF8C283D69A E15824C5D8D7FCC5 E65BE841F96897C9 B3BE48AE0F3D650C 580E78A0419E7121

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231439 (name+title). Key = MD5(password) = e0bdfa8b61393f3703bd0f0925677f2c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 edb5fcab-b0d2-41c2-a557-a9150c9c4052
  2 f90c747c-da2e-113f-9fad-349c3c82e676
  3 2435c05a-8ed9-6127-916b-68c1f4db95ec
  4 4cf76eee-dd20-27b5-ba0d-3078d5ade1e1
  5 842a1a8b-8b51-253d-a473-69788f03c297
  6 b08d1b1a-fa32-0a02-a476-ef9e0f4c5821
  7 cb16c3fc-e49c-851a-9b77-f542db5c5617
  8 cb5a339d-6a9f-8c5e-8d70-31255569df29
  9 67913212-0cfa-31f5-b0d6-f566b153a7dd
 10 9d6f128c-dd55-2e4b-bab3-3450a61622a2
 11 1aa8c1b7-66f7-5c4f-8e7b-1cd93e994aed
 12 8200742c-ebe9-5ae1-9182-651df307953d
 13 88ad2f08-14bf-373c-a0c2-458c6102d0b9
 14 c566b77b-22dc-3a28-8465-7c2fc14a621b
 15 09269344-ae3f-625f-ad7f-50938f277cf0
 16 bf18a916-ad07-0ccd-99b3-8485a8b1c007
 17 37025ca4-177d-4e79-bd95-1fd1d052c88a
 18 3ec963d0-a069-05a2-b951-3c66b9c26e87
 19 54b9018f-7b6e-582f-8879-e413b49ad345
 20 6e1e5524-a89d-57fe-970b-2fb188083fe2
 21 c547f3e4-99a8-2f4f-98a0-3b95469a1dac
 22 74f3e1a7-f6a2-60f3-8c81-851c89148ebd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4162208832553360405526. Exactly this sequence comes out of new Random(884).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 116 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related