201210040221 10xa5m

explained decrypted filler

3DES(name+title) ECB, 19 GUIDs, seed 124

Metadata

Post ID: 10xa5m
Title: 201210040221 → 2012-10-04 02:21 on A858's clock
Posted (UTC): 2012-10-04 06:21:53
Timezone: UTC−4 · title 02:21 against posted 06:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,232 hex characters · 616 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210040221) = 6b8a0414848d292bdfd6f3ccff0e6c27 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 19
Filler GUID seed: new Random(124).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 139 · predicted N = 19 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C2CADF361E8A6454 CF5F05D1FA930F59 712295DCAECA43F8 4EAD5F3B253C2BEE B9C8F60F9D70B134 3DDA18131E1D049B DB3AEFDF8BC12D40 A175C1A38150C713 D468D3F05B27DA50 E81D4960478478FF D554DA3D83A602BB 3F459D2D9416B414 B64DE5C106181D38 ECCFF29686654100 4244BD7E8FCE6A90 C8A036B8B3CE629E 6D84874439233756 CC65D88C262BC838 501B95EA06CE2C60 3B900EB4EE13AEED FBD468358628FE5C 2B023895ADC9E7CB E8DF7785308A9686 8FFE908AFAF97B05 A1B3320EAFFAADB2 031901385E8F7372 04224424559C4D0D 37F7DD6C394F4115 350A72324B7D3B3C E1C5524F3A5D3385 8F5DBD705C36BF00 BFB1A4A8C4C0234D 624E915B5AB382B6 6240B27FDEAA1AAA 401CB504FA866AFA 487E624D9B5DAE8A 7078B3D7F5D64195 50A6573727740862 08E20939700D1A8B 789B5BB64DE87428 E3FEDB57DA8B566A 3C022412F50F8AE9 810D612CC3820FAD AB4E90A731B8F511 9EA91112A233A6C2 E68683F746139327 956FF1456051007E 1FF6982C13A90AA8 0E8FF194A3911551 73BCC26D79C5B4CE 9D1D2C5B42EB1F79 1ECC9D7CB9448AEF 428FD77A50401109 03B5B4282E6626B6 E91787550467E9BA B322879C3FF03817 96AB3172C34EB0CD D2F960594FE14DB3 352D63C0488EE286 6CE1E55EB3B6D682 10F8D28930B435E5 5AE5D1D8998198EB 0A7B34A4A14D5AA9 1C8EEC5F83E20158 F893F0228F0BAF61 6253B3A6A6A74DA0 0FB6DDCFDAA54CE2 AC277B8FB23B216A 610F4E35BCC92603 F553E078158640C0 7FC6AEA6DE9F2184 C40E6AF781560BF8 2F290A3E9F66FEFA C39C33B4E9CAC91E 0C94C5539B665991 6FDD5A1B40660BD4 889D3769ED91ACCB

Read the ciphertext. Strip whitespace: 1,232 hex characters = 616 bytes = 77 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210040221 (name+title). Key = MD5(password) = 6b8a0414848d292bdfd6f3ccff0e6c27, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 19 GUIDs as hex (shown below).

Decrypted: GUID list

  1 834c6283-5e8e-458f-bdc4-601a68feacec
  2 bcbc4131-b57e-182e-be2c-25f6320eefb2
  3 51bb06ae-879f-3593-878e-98329f2a4723
  4 9b9cac5b-72a3-0d37-9b86-aa8fa6f77edf
  5 57086022-f732-1482-8fca-354d017a880a
  6 47833817-2ba8-81fe-8271-a20d7f3fdd39
  7 813f7c4e-0cbd-471f-bf6d-8b91712dc1a9
  8 56111097-e6d5-5a19-af4f-cf3d5858b41e
  9 5efc8737-7ce6-22c0-a4ea-94bd928f10e8
 10 f6982a81-80c0-8b59-acd2-6ea39e421b02
 11 706d90b8-c4be-5773-808a-f1afd3a77298
 12 610d4f70-b752-26ea-9e70-8944ef2913f7
 13 24cbbd83-d638-7535-95b7-a9d3ea1dc8ea
 14 b4d7457f-a6d1-8c82-bdbd-69dafa87ab1f
 15 72f3e703-907a-7ae7-ae74-b184dda846d3
 16 b35c23d9-9529-493a-a46a-a853ddbe9736
 17 a57f388d-e23c-8a70-b7ab-203af22b3df4
 18 223f3035-795c-7b42-bacc-f7badede2171
 19 dca0becc-2b04-037f-a105-fba4d26fbeea

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4130184528527874870. Exactly this sequence comes out of new Random(124).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 139 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 19; the post has N = 19 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related