201210020740 10t8a1

explained decrypted filler

3DES(name+title) ECB, 24 GUIDs, seed 978

Metadata

Post ID: 10t8a1
Title: 201210020740 → 2012-10-02 07:40 on A858's clock
Posted (UTC): 2012-10-02 11:40:10
Timezone: UTC−4 · title 07:40 against posted 11:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210020740) = 30824f5ac638166e58e673ccc63c0362 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 24
Filler GUID seed: new Random(978).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 11 · predicted N = 24 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3AA17E7B5B565CA9 75675E6CBF434D0A 275F3F370B887063 481FB90571A4FBA0 88FF27A696FC25BC 0DDD1CA0A2BE7D46 D8454A2BC3CF87D8 E8376F8C383883A8 2C6D1D3BFDE4EF75 567585A939C61F14 5EAF92E086432C3B CAB172934E2B57EB 6C740153A6A6129B 390FBD57093C7833 C86554A533FBA48E CE3AB3E9A51A564A 2A18528D1CD4DB37 0F456C2E3C619A9C 0B96DD4541B8BEC7 9D84BB5977067C82 19F856FAE658553F 5DF135648A573607 A88951FA8CFC365E 2F6A66F842640A58 9EA059CE8FE7755B DAA101893B42488E F7CD319B2494874F BB39C37F33A9FF9E 74F20F09FBB19123 DDC8F27B3E8B5D88 D83E465FFD9DB78B 5E783E4D5FBE1121 09B97015ABFBD84A 94DD92F141720CD9 42F3BDFC419957C2 144216DC93793229 478AC2C7560E27E5 1044779577C1C3BA 8A81FC6EFA751BCE DD8E0E5EDC901282 B516937886DDE0D9 342DEB7CC3C3A537 E8002A0F03B62621 6CB4942C0A8D51AA 901F419EBACDAB7F C3F09132CA0B5D38 6250127A609D8A65 477A4D328412D140 0587D01B917C95C8 BB53DF6D03144AA3 8597B8B8A988EFE9 C3C827872A96C5DD E9D822AD5BDE71FD 805CA80D9BD87FB8 374FF261DAE6974D AEF7FED4F3319068 30700C6296947734 DD36324F184A56B1 2A2A7A5B0F853846 CFAB98EB25667CE9 741054A0988A19C1 6BDDE6030F9C262A 63B7C20D4D300C8E C5E60A9474E7242F 29F294497482807D B154ECB00B122700 39941831287F08AE 0E57AFB686638EDC 5D38B9BA2DF3CBD1 56DA017EB05AC8AA EDF6237225CE7A49 B9BC43B889BFE166 A64BD69F775631CF 9BD09C87763A83F7 A6668017A13623AB F2620925E1BB4338 F927F2B98485DB4D 884CCEBDAB759180 39D31D0E1C8DD922 433D85773B1CB5A3 CA861626D79CAAB6 FF797159CC05FAE3 DBB8588A79240E18 B460E52B80497305 33235BDCB61A9E46 FBA2E0B33384866C 7827004740D4EB2C 9488F1663B6082E1 768353C5334A9C44 56E0DD8D2E5541B4 664B6C1FD8B91B4F A579FE4B6430F0C8 C4548E31AEAE46F3 04C70DE735189639 07F0E07298438608 1D6807D27C1DCD6D 03A3853B7375F9EB

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210020740 (name+title). Key = MD5(password) = 30824f5ac638166e58e673ccc63c0362, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 76ee4353-c46b-5f1b-9b44-bbe6e89a024a
  2 ca19232c-6c39-7666-813b-2a6aaa2fc79c
  3 0f19a5ca-71b3-3991-84f3-3620fa32e765
  4 aadb0265-6e95-2326-a1d7-16b8ed5b07e8
  5 df24aa39-fda8-6643-b8d7-30c00229d186
  6 47b3ef83-05ec-2bc8-852a-d0331b227d8e
  7 2daa71f5-4fc5-0b1c-8ef5-145fb48c0086
  8 18c01698-b7f0-0f49-87b4-b2fea471a297
  9 f94016b8-6cc9-8668-9893-f79d12f63e83
 10 1f79e4af-7cde-83b8-a22a-e4d928817f4e
 11 7b908dd3-3aaa-7c4f-b716-65a97c91f55e
 12 abaec37b-ae62-038a-a3cc-a29f1dacd8f5
 13 14d52fde-da4f-8f68-b113-6dd185902572
 14 f0e807d8-4493-2d43-9191-95f26e1f64df
 15 02fefbc4-ad05-4063-9271-985da2ddb8cb
 16 1be42c35-0d28-7fc6-b461-d6225f09674c
 17 6851c3b5-5c8d-8ba6-a976-7a4888b3878a
 18 db68b6d2-9756-3ee4-883c-cb142c6e3054
 19 1dc940fd-459d-11fc-a890-91415ee9f244
 20 c8470439-5bbd-0730-af57-7240aa08baa4
 21 eadd02a5-54e4-65af-806e-5e9a339e78f2
 22 8c364130-600e-7af0-89c0-c89b3c081e04
 23 7dc495e7-9c70-28d0-84f7-7afb519a095c
 24 ef4d1240-e014-6f40-b37e-dd65376c2e48

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 573262008870824783106726. Exactly this sequence comes out of new Random(978).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 11 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related