201209231448 10coan

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 343

Metadata

Post ID: 10coan
Title: 201209231448 → 2012-09-23 14:48 on A858's clock
Posted (UTC): 2012-09-23 18:48:19
Timezone: UTC−4 · title 14:48 against posted 18:48 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231448) = 02dbf72d8646b83c00a9e2d6c552c980 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(343).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 125 · predicted N = 22 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

259B4A77B2706E56 470C8AB2150C0DA9 BA706B4DC936DF99 902814491E7FF561 E10BD6C7EFE327DF 88CF34F402E52BEA 21882ED11ED03C4E FFED5623037A71B6 F37C77841B29E4F2 C37B31391B39FE8F E8AD32EA132EBF77 C95C317846A151CE D5AD9E18EF412F09 B64F88BE348FA884 EE8E5E9E3B2C85E8 D105124A6DEB6663 52DCE8776BE53A60 9C396A27B3D9DE4C B8AF7FE6982006D0 7E661B1E8D1DE1EB CA718CC86BF183EE 7EC81DF1B3EF7ACB 1843420489558DE8 557241966ABB41C6 897DEC66AF24B8DA B4A6D2509E92C9AC 80F67964A8C1D439 89D02BB1193A3DCD 3ECDCCE04D6BD100 02E852D678F1EB20 0F0F26EB2F4E4082 53553687A817FC2A 220C88B7474D5655 EC1B7A6B59C75967 115A3A46CA7BDA11 C4DDF5282397E0DF C19232637EBD9AC0 1DE855C7CED28DD4 873E55E671AE3167 979F39076448CDF8 FF39BCDE21D16013 CCCBD02AC42F54F3 46C0D9F2BC132039 121AC104B245E7E2 F230EAAF8D5D9243 3942CDF06ABD6DD8 2F4E526CBC5FE58F AB2264BC6215666F B8F7F73E3B7D23AC BDED6FDFC67AA002 CDF4072592A2EF52 C3751F5D3E3DEF9C 6A6353E49A95126C 34B391816FEE0F90 D4CD6391C06A7FEA 3CA8CBD2C5EEFE89 FB904D2532FEFE00 53C8A352617F8BC3 F25B96B044B2DD58 0A7A1F587BD7328D A8B8E3ACB93B0163 F6D6C29C2AEF6CC8 8BC204121852E514 4467CD6ADD1A3D04 9FD69C79DB0228D3 8C40A96B94A2F0E4 0C62E146F16C43BF 106825057FC7B366 64769BFFE71CE7D5 178F51AFA58A03BC 3122C3695F7F738B 95E2F3BD5ED33DCC 82F7BA9F58C2E66C 6D733C46B01C74E7 7707E781F5F536A5 AB6059CCA3E5ECE8 07279DA4122A66EB 7100080069F03F0F 6C99F6AFB3A72284 4DB2432232C7B466 00B15944B03F9922 2AAF21A043285DC3 8C045770741BE0A6 D22B7304D0EB23E7 862699F14543FD17 2C6E865E3117F626 86CA3CC07CF5D532 60A18F10D719704D 2299F4EFCFC22E5A

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231448 (name+title). Key = MD5(password) = 02dbf72d8646b83c00a9e2d6c552c980, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ea84db44-57ac-82b2-b734-6442d3e3c71f
  2 5f447139-895d-40bd-a22e-2ee622a8fac4
  3 80756839-1b3f-4e15-9fb1-a2fbbea14807
  4 3c596c1f-be46-678e-82fa-4053519d0779
  5 737d8396-3dbc-0d8a-8ac3-e256f7a961c6
  6 9e8c66a0-b584-2e4d-8da7-b3e8f75b3658
  7 8e611307-a140-5d3f-ae1c-db2da4b1f99b
  8 6caf5c52-96e9-4cde-ac55-be6913e07629
  9 b01c54d9-5bbb-35c9-a0db-9f01a27509f6
 10 c3cefcab-417c-65f9-94ef-b188169b8e0b
 11 54dc302f-2176-8c3b-9192-a5fd6cf81123
 12 3181ac9b-d5eb-2ab0-b2a7-dbc8a630c879
 13 435c7853-7a71-30af-9aff-79d65c688a15
 14 d46ea766-ad49-81a7-a40a-945664d9f67d
 15 24f99529-c58c-0587-b39e-bb4bcff05a43
 16 014cddce-2e06-244e-9925-bcb7197726c1
 17 e2256fb1-7c75-04b7-b521-8520e8862de9
 18 981688bc-a96b-57f6-ad68-6d863c09df1a
 19 530753fd-6319-866d-b049-7e703bf2f940
 20 7bcd11a2-eeeb-1269-ad29-ce9f354b843a
 21 110f5c66-b5d2-3bae-b266-32aa6b42bb32
 22 3157b2cb-eb2e-8cc1-bfe6-af21cf5adc69

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8446025436823802058138. Exactly this sequence comes out of new Random(343).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 125 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related