201209241434 10ekkg

explained decrypted filler

3DES(name+title) ECB, 20 GUIDs, seed 972

Metadata

Post ID: 10ekkg
Title: 201209241434 → 2012-09-24 14:34 on A858's clock
Posted (UTC): 2012-09-24 18:34:35
Timezone: UTC−4 · title 14:34 against posted 18:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241434) = 20d99ce4b049f0ab8f958a8b7f3a77f5 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 20
Filler GUID seed: new Random(972).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 259 · predicted N = 20 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2CC7225263E3819C 6589121FCBDCD7C8 F4D5C1899B19CD4C C5EA81F7F7481EF5 67AE0D7F11B6F8C2 1EC4F3AFD09FC868 CA153FC3B6BA205F 21D61B9F2CB7EEF6 EDEE3E4B50BEC31F 345ED788A44D2DEA CA04561607AB8EDD 88F61DED94CC9B0E A06488F010CD6D92 9AA890E0B845083C 49CA5C87B19DF55D 162432FB9CF7FF8C E4D05A2D07E9441B 11C342F48387F839 EC3A04F7CA2B9931 C64ADC5EE121C2AD 709F87C3722552BA AA0EB6EC68F755E2 FDA85663A64FA8CF 9B3AAB1A2BDF2F03 7EB622A6DD861004 2B4987DA8BC986B8 7DEEA9A6FCFD61A7 7D58B1945DE4EF24 A9047C210F1D721C 9D6EA05154DC472D 3854AB902E4F3360 AC9608C0782E0537 658EE0A52749DF96 0318FBC164763341 F75CCCD6145F8A3A 26763550CACD2F10 3A36A00B28AC7052 6DD7C2ED31BF27E0 B523D4072869337F 8301926963ECD4F6 337BBF4200D42DE1 4E243D6234117729 72ACCB405809A613 F72942BA5A0DD22A DEE3B4E5A29DDAA3 B446BC68E4A140E1 269B4AC28238E07C EE6C395947D001F9 E43173370F86EF22 CE5114080CF00A3E 9F7BC4C272464772 7391786CAFCEC925 A39FFEFABEFB560E 1F4BA93E605A98EC 8529A8ED17305920 A6FE9AE431D3C2AF B8AA655EEFB6A377 86B88899BB8C6D8E 499303AADEC72212 4C58D73E654E737F 81C4FBA70CA4A32A 2C88B4C101B33307 1F2EACF95C12974F 2F9E8BC67A7B4319 4F5E5FDC534D78B7 9F4586E860E6C88E 1B0875781EF5D76A EC501703E4753370 51894928657BF675 13138B532B37BE8F 925200FF3E1641E1 A64DEE02BF0CBCED CBB2A0DC505BB58F E656753DF60D72FC 810B3DF361091870 A45645640AB3530B 9450F786D65BAC87 A144936AB12AFE19 1FE8C416F7DF209A 14BE17062179B890 E4115183B75B9A74

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241434 (name+title). Key = MD5(password) = 20d99ce4b049f0ab8f958a8b7f3a77f5, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7d2e5a9e-ab9d-41bb-8402-b2678fd9f31f
  2 5700ada5-0169-0bda-908c-12640eacb629
  3 31aaa103-2b62-1c5a-ab05-bbad97eb0a02
  4 aed0e51a-f01c-0e44-a649-8f3adbb20d06
  5 cc1048c0-6f41-0204-a7e8-0989382f56f2
  6 0a0b2220-4a1b-8971-b24e-4de494db714c
  7 fb443c9f-df89-3073-97fc-a385c78b533c
  8 5d31d183-5caa-0a4f-bd41-33b8cc40b1be
  9 0305b7ca-1d2a-2e4d-995b-3f9878bb4486
 10 919458da-fa5e-665e-878a-6f694b613406
 11 ec806a6f-0a63-377c-9f60-2e58460daa2b
 12 6d8d9bf6-19f3-2b19-8dd0-bd354fa2761c
 13 1cd5467e-88f9-7931-baf3-08926293ac36
 14 4f9249a5-866c-1df6-a45f-4e72a10a0781
 15 321f931e-42b3-34d5-9fb0-decc0e06d20c
 16 e32f08ac-1066-09d5-a691-f6621fd7d229
 17 f224b11b-820d-4d3a-a2d0-7bf4d3fb7ae2
 18 b3c29632-037a-55f5-a1f6-a84b912b37dd
 19 f36c64de-dc97-8b43-99c7-9bd596ffca7c
 20 268e137c-b7a8-6c95-aef1-2d39c652cc51

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 40100830263271304586. Exactly this sequence comes out of new Random(972).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 259 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related