201210050142 10zb41

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 449

Metadata

Post ID: 10zb41
Title: 201210050142 → 2012-10-05 01:42 on A858's clock
Posted (UTC): 2012-10-05 05:42:55
Timezone: UTC−4 · title 01:42 against posted 05:42 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050142) = 134e9396e55e7ef942cc3549b495af29 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(449).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 209 · predicted N = 22 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D4C1E34CB75AAABA 94F72D1AA70054E0 0D3446678CF1202C EB978C318F81FD68 5BA144348ADEFDC7 8C9AD92A8E3CCDD4 FF7DD7BA0E1A3F45 43DD5E84DC4CE911 9076ADEF528F98BF 862CFA65389FEDE5 08054656F036D49E FC3705A3E8566A85 3E1692F1C820365F 3B92EA2FEF60A819 714AB5440A8EE936 066BB15F53B4383F C096F419EEFE350C 9D068C8BBBC2B0D4 66985E37B8E44DBA 4749BAB366B6AB86 6BF2E6A205AFC88E 599ED9A4E167553C 666292CF46989B90 CC02AFC503FF0773 AE7041E7C6E79965 1A1D10E0590436EF 5A8E77FD4A6CD4D0 1566C657B0D79EBE 430B401A0DF46B33 F72BBF1B32C35544 E12EE67D783886C1 C5140B0C27CB63C7 0353D044D9AA1759 94C517CED1E6E9B1 A489740447046B34 895342F65A08A1D8 D76412A37257D669 0FDC7C710BE1D20E DC9EDE9C6376B06D 73298CA2D1728B55 C35A8343702AEA98 A0241B5ECBF3CBD3 7C3DC4CE28350396 3D00862DF03E59D5 05225466003B6B35 9E8947C2B9F78EE8 18418E4E50300010 F3AE7CAAE6600A08 20E247BC1F4D79B5 49AB3275A0E63F62 BAED5648B1D12EFA 51938E3BC351412F 41B1184CB6E7B064 44AFE88B01D2C90B ED7003E88BA1E52A 26D15F50E284DF28 85D977C00D281FBD 8EF77F49E67FDCC4 A06EEB56905CE013 F620D55E9E583DD1 913CB78E5EA83542 E0D03FE8B8010D74 EFDD07BEA58F8F55 4AE7EE47FFBCE391 AD2333B78E3A0135 AEF960BC79A6B8ED 545E8FE9407DFDF1 09AEFD210B2D52DA 81E3221A3AD8B66F 22E123DBE4FB4E6D AD563DBF91021127 F6C2470978E746D4 B402838626B6C51D 14C70AD63F431A28 86BF8F9F0350F97D 8806C0FF620FB443 150CC5D087B75D6B DD5511CD2A3D82B4 2424DAA4BEB3B893 1B42D8CC656011EB 3ECF9E4615CAD76D 991C64BD3471A803 464C6E5A8BCC23CB D80853B5407DE5A3 1759D5A503346622 FBB08A69679A2AA3 71FC790354AF9435 BD6DA627ADA1FA4C D7AEAA2673952C40

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050142 (name+title). Key = MD5(password) = 134e9396e55e7ef942cc3549b495af29, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 73b7c56e-c414-2af7-bc0c-5464ef2a5dcc
  2 6616ec6c-a1b6-54f1-bec9-a3f679bf9d80
  3 e10a2fb6-a25e-579d-9131-9a40704d7175
  4 88bed6f8-2c41-3760-aea8-ab28efe9c368
  5 b59f1c6f-342b-8e89-b616-0b91ffe1cecc
  6 9ce26346-1ae7-8b9f-bfec-bc630a09c65e
  7 909fd6f7-7339-0e20-8387-450f63e145d1
  8 626e4a73-d46b-639f-bf9f-55e00921b0b1
  9 63aaecc9-3556-4177-b1bf-4bc556af1dc0
 10 50b7aa52-c895-71d1-9f16-704ca47e4d3c
 11 35722e9b-5e5f-04a7-aafe-9f0d819accb5
 12 12cdc2b0-e929-05c5-b940-bc0face62865
 13 0d30742e-faa9-2f86-8c24-e14eb26e1c84
 14 3ddb71da-af5f-0f6a-95c5-4edad458754e
 15 de1b7ac5-81fe-2dc7-a49a-db22b39f5abb
 16 d6dc020a-6466-3599-8256-58b838692948
 17 0ad763ca-27e1-5f1a-a344-a785e2ac6518
 18 b6daf0d0-ce4d-3c59-997f-c30ea9d7d66e
 19 fba7a054-7eb5-750c-97b1-ec376321a639
 20 af7527b8-7381-1380-91dc-0a1b1658acdc
 21 3da0c51f-fdcc-4dc7-bc86-a1f085a1d888
 22 fd4dffcd-4fa7-00dc-9a02-0d72f14e43d2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2553880647002023537140. Exactly this sequence comes out of new Random(449).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 209 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related