201209241203 10dhjj

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 143

Metadata

Post ID: 10dhjj
Title: 201209241203 → 2012-09-24 12:03 on A858's clock
Posted (UTC): 2012-09-24 03:03:07
Timezone: UTC+9 · title 12:03 against posted 03:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241203) = 62b65925b22a18435664224dc7bc50f0 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(143).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 139 · predicted N = 22 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D59ADB3F8BDD1496 F44D788E50501ECB BA1EE006187DE711 0F7250CA1E238DE3 90266AD16F2314F9 5EE27ABC47C8941F 51ADF3DADBBF054B 39BD9F22DDCC1182 1FA015D5A6308ACD FCCD606054C5C22C 22EEED4BBF7E5C51 0F4BB76F7B8EA6AF 1E20A00EAECAA64C DE6DF46EB0F01AD7 F1504409184A62E0 EEAA4CB27A272B0D 4EBD1ED8A87DAC36 114C6B066FAB5BC8 875C4D8103BBC34D 2F4934DD4176D851 C906533E64903636 344D866135A80523 3926A353C904ACB3 99A9015576CB2B99 BF69243754662E62 7DF6C1005F4FD145 07AD4F74FF24FA2D 9087F45F412BB6F4 8E71E7136C0A43D2 9FDFA98A67753A7F B17E74594C8F6991 7FD49958ED3BE38D 66EF43A38B94840E BB7CE9B86467B5EC 60478582332F7526 20AB9943E3633AD3 976A43B963913E91 1E9CE17682C3EFEB 78C292B686BBB2C9 F8564733B90D8455 B39A9F41BEE1E8EC 0A938235D44CC315 3A10679C75244123 D078AFC0C0C325F2 CB04C4D33574F032 29736D08F4F017DF 3DE51791E33C1693 62C471C822599B91 9EA7DE6C5F3C6B86 A657C9B10913B5D1 43158233839C7157 5EEAD6E5BF09BAF5 C9AEC76EB5CD1599 205E37BF47444394 424840BD52222A9A 776E0774371D3EE2 AD63EA327EC5F0E5 30BC7944963156EC 48917B80AE573737 318D48C6CA4CBF18 63F1524D6EADA79F A75C4BAF99D83EC5 5A41D24CC90CA019 725BF9ADFC62060E 2E561C86239DD558 21696D264A360EB3 AF78791CC47A31F5 7001B1658998648D C1FC9EF16CF7B3A2 5D2BAFB79D301733 A316B3CB96913539 69ADADA29A931F4A B52D1D4645F805CB FB5802C0C8DE9462 31C8CFA49D0363A6 C59AAF51C79B863A 3DB221EA1921FEFE E61F6878902A1ECD 20C4F73181CA978D B40B5659C1E12C5F 85C268AC78E217B5 AD067FF19EC41187 0DAA9F970D15EF6B 489BED2889139C08 8F9E883F668E6BEB FE33346430FC157E 38AD54355A9D1F5E 5D5EABDB9B9FD248 4C91D18E2652FC81

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241203 (name+title). Key = MD5(password) = 62b65925b22a18435664224dc7bc50f0, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ece73abd-ff77-3433-8e09-f7177e6f9b8b
  2 72e4f381-3f10-6f75-bb96-b3ef68342ce1
  3 a84843cb-c697-687b-8918-5721e50b1923
  4 ad8b0533-aee4-01d5-8115-eb14bd3e09af
  5 ccd411ff-dc8e-6b15-9d6e-5142b2292c6f
  6 4c7b8b28-7828-4499-9bea-d2ed62a3c889
  7 630c2e51-b1de-8b46-9413-d16b05ff8af6
  8 0ee94b33-a590-1722-a5f6-42000138d41f
  9 706400a3-92e9-6d11-912c-f200389321bb
 10 585ff24b-6aac-09b4-b08b-95a724b79433
 11 e5a44d76-00fc-5e1d-bc65-d4cb6d3adf8d
 12 acbb7683-eb47-0c95-870e-6daf4c9a394e
 13 5682ce70-bcbb-8fa0-8541-7c108ae201cf
 14 29907d6f-6eac-7cb8-8308-b2bf01cea93e
 15 04c451ef-2492-0e3c-ac97-46b88a3b9ca1
 16 588714aa-74eb-3ad9-9945-df02389e22ec
 17 c84bb27f-46ee-85f8-8f05-c6b44ec05e1a
 18 418010f9-8646-51e7-a61d-bdf62570b496
 19 2812484e-197f-4df4-90c8-619c43a4ea3c
 20 94a2ceb3-3f53-620f-9bc5-99be012c7523
 21 33af31a7-0413-7518-99fe-8433b08d5262
 22 a4d2d055-29f8-81fd-81bc-777a0d502048

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3660648160508703854678. Exactly this sequence comes out of new Random(143).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 139 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related