201209241312 10dlj7

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 86

Metadata

Post ID: 10dlj7
Title: 201209241312 → 2012-09-24 13:12 on A858's clock
Posted (UTC): 2012-09-24 04:12:56
Timezone: UTC+9 · title 13:12 against posted 04:12 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241312) = 6b5f0f82533b598b0843aed73f6d14be (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(86).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 208 · predicted N = 21 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

81D21BBE1695F52A 4104C85FFDBA6523 AA2B66BB8B521D35 AE0EFEFC5DCDAF9B B2460F8695FD7ABE DDCA6592CF4E4AF4 1DD8CE54C52A83C1 488781E30F681FBC BF1C1A33FB245E59 A60C90FC2436DB54 BDA0871C12F38A6A D4F983AD31C9E466 4419660064A2C87F FF8E60A339ED7919 B22A5DDD783DFFE9 41FAE76AC78E7BCE 5E2364CB637C9484 466B35A1A1061C71 636B827617B5F7F7 0A85DF24AFD9DA44 5880E7C4BD4A0EA9 497CA95B122FEB82 2FF4E4BD9D645EAE C6F9FE2FC302CCC2 4CAF2FB5418D0A9D 2562142F89E68ECD 382153D4165088C2 FCCC0A0637546DB5 A71B601071E316BF 1F69037093946338 59F0B3507EC51D04 6ECA647999A95660 150DDAF5F53AF29F 09C0775CD3E72C78 726511B6A966CE5E D3A68BEE89C86E5B 79F14F45F60B5FB4 6D00B88163019906 A23200B59E1870DC 9B59E98B29F7EA2B 0D0F34824CE04A5E F5055F2A7AB35E91 3B7967C680BEB969 FB6CA88C56366951 105AFB577960148C 279A98FDE50E2F46 CE66DDA1CE7229A8 330969A9B885EC00 208124D5CC39E739 2740B3ADDE36E154 0275830EE3A6BE6B 9428A1A7BEBD92A9 271AEB197F59686B 6B8DE6CE3B9F763C C705A99C56986ABD 86821FFB576E3B5C 2737EDC64379AD4A 6AEBE2BC1644E459 0F3D23C5EC405173 8523246378AFBC56 7213463CF6BC8EA4 51986E6D52CEE283 C4480FABCBB37A89 6DF2B7D59E1B62C4 D977DADEA9862D76 F40B83C0B5358BCA 31203A474D2D8B04 7EF5E7B0B70CD497 2ECF981F4BD598DE E0AA0F532E688023 50969488726E9703 12DEC516208E78A1 44ED2988D075B6E3 D8764E9CF6D76BF0 61FEB076BB7B6ACC 33FCD1CDC3575E2A 5F8A8FCDFD8B7E54 A8FB3895F025B75B F8FA4AFA5A08AFB0 703ADC9B746C0ECE CD81ACBF27C3168A CA49DA1139427FAC 3EB945398C82CA56 F550823B09866DD4 10A3ED2E498A4D77

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241312 (name+title). Key = MD5(password) = 6b5f0f82533b598b0843aed73f6d14be, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bb54f548-6a09-5f50-8e94-eeded50a25bd
  2 5f9acb39-469a-0dd0-bb31-c8b574e2133f
  3 8e125075-207f-7dce-8f3b-18b04980f0d4
  4 90910542-b2fd-88d1-92bc-02f32a3694d7
  5 b1128cff-137d-0e8c-8a00-0d4fe89c03c1
  6 f6e1ac92-2860-68c1-ac7c-32fd9f154a1c
  7 9fb5d80d-0af3-3506-a779-c3aeae209f49
  8 7a6bf102-e58c-5895-8a4e-0520b3af55cd
  9 0c43824b-2553-58e5-8f6e-5019c314dd43
 10 62cc7d9f-e372-8784-9294-3ddb178ac96a
 11 75c04365-64e4-5010-bc30-54e6c35ed5de
 12 615c714b-9dca-5901-af96-e430f7ee10bb
 13 31f8a9b7-e5ab-6979-87e6-748f9df0bb98
 14 1cf80091-6476-186c-aecb-9839112b191f
 15 f899a6f4-b66b-134a-a35c-670b09b86785
 16 45d071fe-1ecf-667b-9598-0c58d072b5c3
 17 22c0cadf-f073-0735-96d9-deb188355ac9
 18 9faf064d-606a-23ea-9490-95752be143a3
 19 7a07eff1-b218-0c7e-bb46-db5b4474142d
 20 78b01f10-908a-5c9f-9c0a-a87f2854f023
 21 829aa521-2d32-2ff8-b91b-5189cc5833ee

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 507806355855611602052. Exactly this sequence comes out of new Random(86).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 208 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related