201209231447 10co87

explained decrypted filler

3DES(name+title) ECB, 23 GUIDs, seed 766

Metadata

Post ID: 10co87
Title: 201209231447 → 2012-09-23 14:47 on A858's clock
Posted (UTC): 2012-09-23 18:47:19
Timezone: UTC−4 · title 14:47 against posted 18:47 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231447) = 2b46c8a790bf582f7ad397ef239a9b7e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(766).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 124 · predicted N = 23 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F960F94B50B95470 C215B1C8E33A6D40 40D9D93CCB534460 362CCDA14FDA963E 60EF815F7B8361FA E413934994895E44 85F89C1DC3A95FD5 76E4EA7BBF9E87F0 0741ADF644C49310 E735280F9E50AFDD 98748C71F5D6D464 41F0A43B632A5AD5 08A51C9CAA802334 B5B91E1FC256D9C3 71107663C075EA02 1B9373FF01D85298 96D418AF2F1A8DD0 53EF2FC1B6CC469A 08D57F1856D5D974 97FDF301591EF39C 2782D33422255100 6D3472259BD1DE57 CEF3DF0A05D5DF4E FE77BD0116317F78 E853445152D9FCED 3F839BD3C1BB7AA9 01200EF4A053F35D 04D6558415137347 300E2B7009D50B26 CB8550A2B6727D86 E7C933BD6E2B9A8B 17A0C2A633A7D493 F26C6AF7EAA7DC37 D7F2C01DE9D2988B 5EB55D0C48893D20 B839122B5733FC96 6CA01A71E18E24DB 98D4AACC2429A66A EE813ACD4B9770EB BA0ADB935020391C AF8B9140727BD922 99CF73582DAC9747 08D48B6E935BBC32 BAB7AA36A8CFA50A 7B9B3BAC93F3825B ECF1441B41CA2F39 EF67F570BDF4B1B2 622FE962F585D3F0 377CC84505CB920E 31E48A909DBD67B5 32017278D90EC6AB F60AD4CED7C7900E 3E2763714EC190E5 E8FD363BBEBB9684 3D6CBF89CDF6D345 E390E32239D61C81 5E65EF7FF32D1523 D89A4079482A7880 94B7618135A8075B C69421D272BDDDC9 9FC4325389C3036E FD1739039A363DBA D266B15F3C698876 77F5B972BE74E38E FF9E842BBEDAF7B4 60D183862F8F8476 1F029E645C0C8EB3 6250E3ED88B051F3 7BD2576DAB04CF7A B98F5DE56036E13C 1BF7B0BAE8AA9E7C 60E058D0B0AE3E6B 90041A661DDB959B 22826C68AEDD4EE7 62ADB790115F144D 2E058AB81D495716 0921900C058DE92F AB7BEF1627A5739D BA65BA163B6D5647 C3D9DEFF9B7E1E1B B618D1DB32096931 85F5297B3317F1ED 841E79C9014A4DA7 B7746D5F6EA7B678 6071C44EA8C34826 5EA558048F6E5B51 4FC657CA4D7F4843 E4A59DA9D853B802 1A4A0502266F2E11 A8CCF24F456A9CF8 1245286FBA9BAF3B 40E18BA960B58E89 7658F9958C8C0450

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231447 (name+title). Key = MD5(password) = 2b46c8a790bf582f7ad397ef239a9b7e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 538329af-14f7-896a-b5de-d252c02501ad
  2 18022850-1c2f-50c4-b0c1-c9557d321048
  3 d782f4e0-f6ab-1c09-968d-c2dd5638e20b
  4 cfad7e9b-23e5-0e43-982f-07661672bff7
  5 d175a74d-36ac-05f6-abf9-3bb996e97493
  6 2c413ac7-0538-8e9e-8e51-fedca70a917f
  7 95828e71-3015-1b16-b766-f65340bcd2c4
  8 e960ea17-8c6c-65a3-837e-65928987b246
  9 fc7655fe-0e82-66ab-965e-78454f7f2177
 10 8d6df435-0bba-6078-8545-4e16abf11ffa
 11 cf5a9101-b489-5b3f-a713-23feb50b1ed1
 12 ebca879a-012a-48bd-ae09-c89b53f3e63d
 13 dc694451-6ab4-1a5f-942a-3adcea85e34a
 14 d1ce209b-9af2-8006-be79-72eaff55702d
 15 e13d9b9f-d124-1f69-9c11-126de59c3ac2
 16 cd3e325b-f074-31df-a65e-e4936dae3e94
 17 1aeb1ca9-f567-715f-a24d-731fa8704b05
 18 fbf78ba3-8303-8e74-9a21-d803da283783
 19 c677d58e-9f91-335a-bd79-0ff780bb1d56
 20 c6705dd4-7998-8bcc-bba5-3c73dc638bf0
 21 ba3b36de-a154-598e-b7b9-19f85ffcff62
 22 5495315c-700b-6048-bef4-c9736bdf2f58
 23 6ecd151d-a57e-4de0-8ccb-9920a2388b0f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 85100816665418137838564. Exactly this sequence comes out of new Random(766).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 124 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related