201209241325 10dm67

explained decrypted filler

3DES(name+title) ECB, 25 GUIDs, seed 295

Metadata

Post ID: 10dm67
Title: 201209241325 → 2012-09-24 13:25 on A858's clock
Posted (UTC): 2012-09-24 04:25:04
Timezone: UTC+9 · title 13:25 against posted 04:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,616 hex characters · 808 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241325) = d8d4f1c593c9c12d26db0344222eec51 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 25
Filler GUID seed: new Random(295).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 220 · predicted N = 25 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

03E041DF2EA98BB8 7F614117C183905E 7703F2E82B188D6E 6D7F6425EC927470 98280E1FC73B7D1D 23D755C89C46F1F3 C7AB6928921E6C57 D43C8F9418335D56 29AA4CC790675C06 0BB1F4477D419E8F 920F705C10268E40 85C4168A9DF88C8D FAA6C1E5270971D7 E333251C643DCA99 7923A80E60A877CC 626FEC1F3240E109 EB02E6C5B26D9DEC 3F8C3E668D6B62CE 86C25D99DA794ED5 79F9E296E2C40C3A F5102231EC3E9963 18B084F98EDED60A 26A63526FC346F0F CE576254A68E4E0F 37DAACC523558A7B AD8965BE4B93DBA4 F92C022969CA5819 FCCCD719E5121960 9578466E6DFD893E 29F154BF2BFA9614 CC70DC61816D6CEF D551B84D0DEA51B0 32307545D98516C0 D78A0ED9230250F5 2B11B11EA0B33B98 CE61CA5C7A4A3C54 F362A461DC9426D1 1933E454FE02B7D0 D340887C210F5F7B D50BCBC9DCB09AE4 74182F3DE349A03D 1A4AEAAFBC923046 92FF9FBCCA878B26 9ABAB2A10E20CE01 43FDA9BB48193D50 14B0CAB2021C8311 0F49621B2023F2E0 334FDD838614340E 4AC8272DC93694A9 FF053E7083B6B5DD 67C2903115E40808 3E0D301FB73100A3 E46450BD9CBCD54F AEE1C31B998A37C3 C4095966724E3F45 CCFBAD4E3C8C6941 B0705077399791DA DCB91BD254E6D36A 7D1C71893ADB1411 044F915779E34119 C311CC6BA4A4950F 535E79D105CF3463 07567FDC4530A017 8BC14D643E0085CC CB815F6B9BA99047 D12A4AF4D7275F78 4B152F95AC7932E2 C7DC3EABDB151BEB B8B32F1FB52CD015 68597C3627C31497 22733AC79505152B 029EE83FDA8900A9 38912942B5FFA8AE 2596A05921D13D01 3382E2BA2C1F9FB4 08AEF218E7B940B4 C67539C31566578A 8F425879A653C099 BEDAFAFAE52799AC 0D1D1E771AA6D4B9 8F7BF03431295EF2 E5420085C6F16CF9 76FAF2247CBC9856 0B9ECE46D610C01D 08E88F2E432A5C1A DCFDD8386D4A33E0 BC9B1D12C5553704 07738E251F0A2C62 114098CAB02204F5 6031F63431E73769 F839DA935C5574EC 21CF1B548F76AE0A 675387A3AC224FBC 59218F572F57C6CA E5CED79486933113 EA55931BF6307BCB 67EF9D033143EB46 C5897488E25DFE99 0E83445F26619BCE 4478C63C67C3F8CA DA5272569E88B6A2

Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241325 (name+title). Key = MD5(password) = d8d4f1c593c9c12d26db0344222eec51, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8c02d168-d466-75ec-b276-0423585fcebc
  2 17f3db6e-397e-3d8c-84f5-77e4c6a92ed7
  3 27054171-b417-8cc3-be57-2e80ff1426b4
  4 b55aaa85-3144-47c1-8cfc-036649a8be56
  5 1a6fe30f-68cd-37f8-84b9-4cef953fb1aa
  6 07a0184a-996d-314d-b84b-a09434ebe7ea
  7 f488bccd-9f5b-07e8-8670-b77d72d012ac
  8 2f3182d5-c404-3d27-a75d-a9ba1c8f93f5
  9 c8da5515-ec55-4d6e-bd54-1a67a71db5b9
 10 ae8a8404-888c-0a10-b7ec-a6dd4f6eec5f
 11 5a83f137-7d92-515c-811a-86908b5bdaaf
 12 c10245f7-72f2-7f51-a396-c6580a74dd52
 13 a7466540-1aa2-3856-8343-01df3bc82d34
 14 688cbe12-a9ac-863b-83c7-383c22bc4b13
 15 e3c31882-d86d-4174-9942-a2c05f98cf28
 16 13347648-493f-2998-8652-a39c92c34ff7
 17 299b01ac-c9fa-7f03-afdd-1dee97588d82
 18 21d3b8a1-3c23-8e16-a180-cd9b391c23d2
 19 f38d6936-c244-5183-a18b-5127c61f82cb
 20 f39f3d6d-10ae-438b-a8c3-3e3f973feabf
 21 955e2aaa-15d4-0ad9-a0f8-4021d1ac8ba0
 22 41486fe6-1927-2557-b2fd-daf422fb6af7
 23 bad9115c-7e28-7cfe-842b-df765400f497
 24 3ed79e32-7d0c-0f92-8214-a5ac679c4607
 25 99391e01-f103-5390-b31e-9b4a1d57a3ae

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7384330340573842785402705. Exactly this sequence comes out of new Random(295).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 220 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related