201210021640 10u3kw

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 685

Metadata

Post ID: 10u3kw
Title: 201210021640 → 2012-10-02 16:40 on A858's clock
Posted (UTC): 2012-10-02 20:40:32
Timezone: UTC−4 · title 16:40 against posted 20:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210021640) = d06d542e3637b7cd4961a64c105fd713 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(685).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 38 · predicted N = 22 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

927346FE97D6BAF8 AA2AE226B286B74F CAAAFCB3835E3BDE 12CE698F67229819 FFD170FD07BE509A 9EACDCA44722B7FB 76D98DE8C79838D7 2EE8E2351C8FB3E0 5FF5D30815464851 BBFB966D444508EB ACE7B9259FB8D668 248D15014514BACD 3237DFD4C4C717E5 01DB8A1D1A703FC9 BC193A3C4200F2BF C7249CFA75F9A82B 2FEB2FA002F3D2A5 84C5842832C432A6 FF989D9B75D99D30 DC3EDE2CD427C88A F9748778998170EA 3C130A4874C38DAE FD6ACA0E8D563C08 29B53AEBEE005AEE F17CC74005849F8B BAAB5C15DFB90AD0 FCEBD1952B5E61CF C1B8DC1327475686 9462359341BF806B D4D1AFEFFB1A9E3A 6F8A528313119346 D85CDBA033AB83F3 CFA6FE3B5818D051 45A075223C704A79 24764BD52BAB1806 5E9BBC80DF53BFD3 E26D85C8C973E8D8 BDAC9A05B263ABC5 009FE25BBACA048C 920C792CF8C129EE FC1669A8B091F7CA 6B952A39EBB0FB7C D596C56312218E5F 2B469F73BD4D3E36 ECEA5C1AFCA80F66 2F5173812C3D0E61 CEEF18E215BF375D 16313B62E8DB9FD5 11A8158AD5A59D33 E898FD9CEC0107A2 74B233FE20188CCB 000CA099C94A797B F98D658F7B5DE7DF D1510E16D9AB8D77 333E8D9664973E84 E8FE5B06103CABC3 7EA34CACE0EBBC3E 97B582B2A0814496 AA175AC99424476D D4DFBF844E320D94 96ACA50F0FF6E238 5489FB8A937C8E2F 06057FC5063FA2A3 AF7060C1797E9CFF 98FAE35E8529E49D A11BDEB941AB28B6 5CA5541EE12D43E2 F3EEFD027F2DCCFE 764EB89407842218 FB597322F538F8D7 293FF05D8736A84C 9F35198770FCCA1C F753C0402EDA6607 488DA7C0B748F8C1 EBC84ACE48F8944B 41DB888C6B3ABD1B 954B2FFD98635AF0 5BFCC5575EDFF299 A8EBF87EFD456219 228846992C820F9E 02E0CF55C71C886F 24D548EE8EA24F40 421F943065FBCE24 8DA16DC182ABFD76 F85584E7D3F4F7EE C83F74E0F4A90865 65D899883F6C1D75 BD4C118457D4865D AB1461E7E482DDB9

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210021640 (name+title). Key = MD5(password) = d06d542e3637b7cd4961a64c105fd713, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d47fb54d-f008-5635-8c01-7ce330da6b02
  2 92ede0e9-624a-7159-bc43-e73c867ece17
  3 67d04047-4dbe-5b39-87e1-e347c7043568
  4 fa621c01-3c48-6721-9f60-fb0a2508566b
  5 16316496-b508-4291-b3ff-c2bcc03e7a87
  6 bfeb3e48-c95c-1aba-80d4-10b3efc2b381
  7 60a8f337-06df-7d09-807b-56b5f720e5a4
  8 81c9a69d-ef0e-0873-9262-42fae9cfdcc6
  9 9a802b03-5908-6302-a888-d842b00f0edf
 10 c7140f71-66bf-7cfb-bf67-b5a8dfa9e4b5
 11 888414f2-fb96-8b20-93f7-fe7ee68c5e33
 12 d8ed1538-5710-268f-8a01-89a94c081bfd
 13 c86ca5ab-e208-4a33-8d0b-f06b7e9d95d5
 14 6400e501-3222-7b78-a0a1-f9d85f9efb4e
 15 1457ff2a-4596-4136-9afb-23b9b4e9b0bd
 16 002211aa-0125-7380-93bb-d4076909d781
 17 baa58bdf-afdb-792e-a3e8-7625edb0b07c
 18 9fb709ca-ed29-6a1f-89f0-f2065ec5d3b8
 19 3ff80d13-69f4-1e41-8d7d-306e761b91aa
 20 e96ff621-579f-4b6d-b599-01c722b524b4
 21 5c364321-19a5-7078-9323-bceb5f56cee4
 22 a4451b30-448a-8871-8f65-d610912042f2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5756417067824747761478. Exactly this sequence comes out of new Random(685).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 38 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related