201210032301 10wyqh

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 749

Metadata

Post ID: 10wyqh
Title: 201210032301 → 2012-10-03 23:01 on A858's clock
Posted (UTC): 2012-10-04 03:01:46
Timezone: UTC−4 · title 23:01 against posted 03:01 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210032301) = 525d1d911bbdefe7cfa1c8fa85177f1f (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(749).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 129 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

23ACED02158471E1 E3E1A183E5B20AC9 49C790F8323982C1 70B9FECF5D191E4C BEB6E67E45D4E215 B3BFA01D6D26C010 BD64CFEDA81B6879 F46F755B6C903532 11E856AA4AD7CF88 075BBCD9C0EEC093 A2E5CF671948DE5D 827EBBA5F86DDE4B F9687B09D7E9D891 0B8C9BB6C25B0889 762AEC74658A0310 6EADA390438BE49A AF74C908E7134748 A19A13A0F6CBBFC1 DBD9CBE3D091BA5E E50AA07A76F40A21 7BD7DBDA1582F857 968C8993200443CB 114098D15397F80F 43F7E3CF6E171C49 FA08A8E8EF031C0F CAAE9CC0399F30DB 0A9A1EAB74734DB2 E429C9D950F130B0 F8DECA364FE486DD 200E9C382606424C BC9542EDB0E15FCE 7C6F3373F41EDAA7 23AD6EB9E45FDEC7 D7650138F6C0D7D3 F5BAEAD269A4B6D6 4AF96AB18C6A1BEC 78F18EEFDEE5C83E 67A536CEB471BCF2 5B59F7BD5FB63A6F 9A17C87A85DAD7A5 08EF91E57C8B40C7 EE74152BE959A380 1E184A1FFAB18E19 79A51A1FC7631C7A 36F6EA239D18945D C9EAD030E1A1F811 13C160520F7AB68C 4421EDC70ED30AC3 B2FD687DED604491 0873A92F99857CFD 2B37AB2AE5640444 140CD842FD52F9DD F1A7BDC4F65A330E 3FEEDA5575E0F0A0 DDD2843A720217E4 F42D10685DC1D37C 675BBBE309DDDF06 03C89D2CA7222E91 6077B18F40D5BD06 0025A51424224C6C 379819B63FC41F2B 826A5D0CBD9852EB 75474F1E5039E0E4 0F2BC690ECF2260F 470CC56158440760 ACA396CD744F4089 B4D103B6F1F40DF8 7E6605648EFA3A58 DDBA599268B4A968 3442E3CCA70CF4B8 9F57BAA4B95327DF B8F46FD6B2DDA17E 00074A500B0437A3

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210032301 (name+title). Key = MD5(password) = 525d1d911bbdefe7cfa1c8fa85177f1f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3e940b6e-d66c-05f9-880c-daa9024a60d9
  2 9413160c-8a18-5a6b-84b6-8d207ea80f01
  3 efc2164b-8252-22bd-9b17-e02747b79baa
  4 1475a284-c1d0-3b7a-8c60-af774181bf40
  5 f638f9cd-cf07-3d90-ba9a-754569649bd6
  6 41d505af-bdb1-098c-abd8-2281dd7f3331
  7 2ca52ed2-9ccb-469a-82e4-aac709bbb0b5
  8 bc4d425d-f2d7-12b2-892e-d23b8f06f6ea
  9 cdf7e357-1fe1-5a2f-8bda-22da29b2e619
 10 67b17c59-4c9d-4024-84e8-52c1c376d92b
 11 ea4e18dc-5116-0797-9133-0dd115b2df8d
 12 846047db-2f3f-2d74-9c07-d1ee4fbc563a
 13 8a3d1eae-3b32-4b6c-af54-c6d37259398c
 14 dbc2983a-467a-19a5-90ec-2e32b845a7b2
 15 8c2fadc7-bbf5-2561-8410-81318cf664cc
 16 34ca95b7-fea7-79a9-b9b5-43d94448f990
 17 6b2cdbdc-d8ef-68a3-9a8b-bed5339c3848
 18 64855b0e-2214-3e32-a0f2-fc2abdf29fbf

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 052330415402412763. Exactly this sequence comes out of new Random(749).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 129 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related