201210031501 10w1ip

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 498

Metadata

Post ID: 10w1ip
Title: 201210031501 → 2012-10-03 15:01 on A858's clock
Posted (UTC): 2012-10-03 19:01:26
Timezone: UTC−4 · title 15:01 against posted 19:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210031501) = 6e081d3dc38305d9f1a900543a79f29a (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(498).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 105 · predicted N = 22 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AAE3454CF35D9CAC 9D2BA6F442146B34 B95CABE890DD5181 52F53182C3111E13 3AA5F11A41DE708D D1ED3DECEED1A593 76CEF4610EA00D68 B4C3ACF36C953086 B0D81A2DB8F81231 010CBC161FCDAA60 07EC6CCEF276DE04 988B69CEE4EB2887 FD308A135022A5C6 7EFC8C3939733BB3 0C7C76A52DAFC96A 666BD48AFDC3F8DE 8DEEDC6873C77FE4 3E1750982CCDD89F 61280CFF32DD6669 7D14894382C35E91 6DF155A3335A086A B8A100618F2371A7 244A3D9061F8E358 2071F5EE7A069605 DC36F8DBCAAB8791 EE3B250599B2464D 6691114B635F7D80 9A41830D7FC99F10 89797E2D11638F57 E99760F938C8B123 D22CB113538A9925 8D30469CDC2D367D 0C5F7121F644DD28 E8539024EC48D0E3 A83F00E7A2E7317C 6FF559A08544FF20 4D7C45DD64E67339 CF9C82DE8FAE08D8 E767C3564C8A3BB1 0E91B4572B7EC34D 944B06E7387CB4CB FA2C9FBEA701F91E 7A864FD499C50BDF B733E256F28C1D25 6D829AAFBA021B7F B346918A37C97699 C4F1EEA6B196E108 F3256C947E55C6EB D81CDD93B909331C 0620C8F0BF8C4F8A 43739A2580E35FF3 8A093112E83D84CE BFB0F7E1FFCBFBF0 E686E2A6D307C2A6 E0229E8C14F40B61 8426E68CEFB994EF F016CF49D69659C7 692670E79DA5B206 056B33696A0C53C1 74C3BCD8C5C62311 FE70313DEDC5EBDF F900E40EF74F85F1 CEC1CC19E29DA266 F1B86DDDAA539900 8E701EF0F17CFF87 272C9D4030810EB4 39757983D21C2A54 413F99FA7113C0AD D2148D0E309DF49F 45F340102256A942 1A87DC92293348BF 8D438B7A3D3DFE3B 35C4469AB9DB7A12 D4C632309457AFC2 508AFB5F740414EC EDFBA07A8A486AB4 FF309F6B60FDEC8B DBBBA099BE028E82 B863282A6B87A8EF 98EE181F2B465131 C2CF28EC0DF37100 8793A8120E6A4676 CD5A8FE9CB08EAF7 CD29C13654CCE2FB 39E06D6D76965433 301B2E1F02BB8E0F 22F70B2BB2B3C55E BC40B1A9A8E0CD57 462BAB12F20364BC

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210031501 (name+title). Key = MD5(password) = 6e081d3dc38305d9f1a900543a79f29a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 96567e84-278c-8d51-9dd6-947a657e6c74
  2 6b0a49af-02d9-8907-8b37-02b7ccd3a9b4
  3 b97f3235-82a5-7967-a898-a9230a207f04
  4 4faaf06b-5c0a-7208-a0f3-d6910beece80
  5 21371c24-09f8-014f-be0d-bedc90233927
  6 b0d7100f-8213-68c7-9e1b-4d54ad13e5f7
  7 1a46b941-4c1e-0cdf-b619-4e68f1c44bb8
  8 af2bda84-e67e-256d-bad1-3b07e8bb9874
  9 6721774c-e345-5a3d-b313-4df6d7efe2b7
 10 9e88e419-96c6-8907-9f86-4bdd0738b94c
 11 3ab3d6f4-b27a-100b-b8f2-5551c2bf54a3
 12 25eae129-1f20-2801-bf43-3ef1e06b44bc
 13 0ab79ef2-034c-8a53-ba81-e2b77df4dd3b
 14 8441e902-5cad-5ff8-85ca-fc839b912c3d
 15 ae0b48e0-c0b4-5250-b9ad-acd5cbab34c1
 16 28cd9031-7537-0f34-9744-6a21da12cc96
 17 0493b809-3de6-1b4e-91a3-52130d4f62df
 18 ada0af90-a370-6782-a200-311f4865eaf7
 19 99ee4656-c792-19f4-9158-eb990f243a38
 20 ff0ce8cb-feea-138d-ba0f-f869a2349763
 21 972e6e57-c8d3-8e3f-9fde-844ec523c759
 22 f4ca126b-e8a6-0a76-9ca3-08101147d850

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8877060258128550161180. Exactly this sequence comes out of new Random(498).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 105 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related