201209241423 10ejtr

explained decrypted filler

3DES(name+title) ECB, 23 GUIDs, seed 920

Metadata

Post ID: 10ejtr
Title: 201209241423 → 2012-09-24 14:23 on A858's clock
Posted (UTC): 2012-09-24 18:23:20
Timezone: UTC−4 · title 14:23 against posted 18:23 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241423) = 8c8fc71f4028118d43ab7528142df844 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(920).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 248 · predicted N = 23 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

92EECDA1088A8DF4 FAC86DAFE4BF735F 6D79CECCF92466D6 C33F7A4BD1263C9F CECC47E00E2A971A 857EA5CA7542776A 564CFA1275C21982 F55BBE3B2009BE3C 579E3F3DD81D326C 897732A2291F96FA 35E8FAE4163C9B9B 558D894B41627E9D 9C27F300AF41FD79 C6BF04E2BDF7D251 3E685E1A087ADFA8 BFCB313B7D2CB7CB 791A6ED26A285427 7BF74B815B6388D6 04143F2D20766016 3C430B04762E9DD3 933F879B5AA5F5A7 6DC7BBA0B8A9A5C2 F375AE679EC9EECE D31A77A94640A1DE CB5C3FB1683F3618 443A08A58A96CF8F 838CFF89DE185B5D 42A1C7092A6E2A1E C15513C04ED69ABE 2FA56781D7A42A91 ECFD5B41E8AB1044 5930D6AF96B22572 6A058FAC60F31512 8DBD3972630D155F F5CFA14C8D8C621F 82D328F9E2F277BA A5FD6880EB2E0A63 619093BCAE2FE13E F0F0B5B8F96202BE CA0B4A0DEDAAE73C 8611ED660010510F 54B7E8032E431A90 57F9A4203D0A86E7 EAE8210501BE4382 3B29D59E4F77EF88 48844549DF94457B 59409DC3A91F3E83 990FA0DC420EDA60 F2E2FE4818870AC2 BC92E660E912531D D11D1D7F28832CF9 925A528C769967AA 7595412D3A0B9FB9 7A4E50D27F6A4386 37FDBD64285799EE 2D6750218C7C4112 8E9AEC7BC3835E15 86BEF16E2F5D13A6 E9427D225807BB86 CB0F726DD7EBD2FA DB80E8BE5FA3D8DE 6D6A1FD0959BDB03 2CA34CC9C2C34036 FCA2818043B368CF 3262DADBC6D97768 92BD6010E4CCB839 72DA1558A826C20F ABBAD235C69834DF BB5E20F3B2B6A2A9 3C4D6FEADE196B05 1D0C6DACF30FE4E8 59DAF8FD736C8B6C 2D74E18D1BB30CF6 A9003EB99C108CFC 80CF060BF82D5906 E4CB602D2CE7F7C2 6A38236F3BE6B375 377F7DED29433B44 166E69839B85F36B A344305BC0A65863 E3EADAEB8D22640D 2DD496829006B314 C0477F83FEC7BDC4 8115BBC1A5B15D53 FBB934397C6EE177 F761163C7ABDBB03 6FC0E9FC2C188E8A AA1D24178611BD6A DC619500F4266831 025D7995CE744138 7FA0D773F6A0456B 0294A9C8A481F2C9 4D3B546B63D7C407

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241423 (name+title). Key = MD5(password) = 8c8fc71f4028118d43ab7528142df844, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fe57736f-8f5c-38dd-81f8-ccdaf3463cf9
  2 434fec04-67e2-6324-8183-3668625d65ea
  3 aaf2d373-5886-7b48-9b9c-c5dc60688742
  4 53041a6f-2f4a-8908-b32c-38fda03df722
  5 68fa0bef-4a00-5f31-9962-9ccb8633e3e2
  6 71a06cb1-791e-415a-bee7-ceb2d6caf4ae
  7 53224312-5fcf-1ae4-86e1-721949272e1f
  8 3f5d2a28-92c0-87ec-bd2c-238e711e1314
  9 1374ce12-9152-7601-8a14-b4e543136262
 10 343c30e6-1174-45bf-90f0-0c9b1cf09c92
 11 17eb3f43-5ddb-06e4-bd0b-1c78a2b523b9
 12 7ac3a9f3-d197-6d03-8a9b-f1aa5551bccc
 13 f96fda92-db32-0615-9056-39317bf39eac
 14 6a864dc0-5c1f-0577-b40b-eb2131ef0cd8
 15 ad86394b-8a18-8288-9ae4-ca2f6e6de9c1
 16 a63bf848-5bc6-5059-be95-427211aae86f
 17 85f10d9a-ebe3-5ea3-9950-3acdda9a7830
 18 655e91c6-ca26-36e8-ba28-38ba3507ab08
 19 05324414-0782-5937-8c6b-e38a84cf91be
 20 9e905897-5c10-4d81-9192-d891df7d217c
 21 0c1e9eb2-88bd-05b1-8ce4-2b99603b748c
 22 fcf8211d-4bb4-5efa-914c-cde87d8e1e06
 23 1157afcb-2cb1-4ddd-8d9e-5dd25413bf70

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 36785418740600855354054. Exactly this sequence comes out of new Random(920).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 248 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related