201210050543 10zi2s

explained decrypted filler

seed 616

Metadata

Post ID: 10zi2s
Title: 201210050543 → 2012-10-05 05:43 on A858's clock
Posted (UTC): 2012-10-05 09:43:05
Timezone: UTC−4 · title 05:43 against posted 09:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050543) = e757c0d3ad49eecfb1dfc640ba8bbd66 (name+title)
GUIDs: 24
Filler GUID seed: new Random(616).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 221 · predicted N = 24 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C561FD156EDB57A4 A79E3CA267D6D990 05C7AA44A8C24D71 FAE4F3D978BCE841 F93C927FB0C6A381 B3EFEDB9522D61FE B1358C2FD191AA16 8ED148B9126630F1 9A14E848870110FF 2FF860AE635190D9 6412DA280C7FFA9B 11DA0AD8F40BC59A 487BB48D14B1AD82 3CEAD430716DC6E2 9B5226FFA82930EC 79D989149A196C0E F4CE4E50E3B779C6 A4287C1CFA34C379 24DB34792A278F05 EBA44364A89FFC7A A191F8AC5E16E1FE 97DA24634A289A5E FA3F938407C8E369 36E8BF4C5E567E06 AD6E71E583FCBCDB 31EB138E6084C4BA 63445933D7F809E9 C5AD7B67D81E6B43 395D55E2CAE44136 21E230E2462242AB 461609948EB3F112 BC25C6EA4037B0A5 A0240B027314BB73 EF9F0C60ABB8A5A4 63C3F149039A07A5 28E6A3D5943829CD 0BFF611A93DFF118 06814B2537151788 BECBBA560233AFA4 05CC132893D36F8C 59C95D1F27CD88FA D8B9CE5A45EF75D1 0DB499D5E12F96B4 AF2E1CFA7A3BFCDD 45C48DD422310F14 21AC09923862AEEA 5A1562775CECC18F C8B9E4F3814315B6 85D2E2B2D65ABF49 8903B11E560ED1DB 3B0825663D51CAE3 E5040F0724F4E7F1 5ED50663B30D57F1 DC6855C076FB44F3 C41F2670B1E976DC 9569383A92EC2CF9 46589B70D28F8B0A 02B7782B03EE0685 0CE843B66204ABD7 B12B6E2069170090 119FB3E6DB84841B 1026A502B8BFF280 96E8C634FD581EE7 48998AEA579F52B6 5EBC49A1B1E652B8 543D616500A84EA7 F489D31C4115C85F B837955FC896790D 7C68F6BD9146110B 9967AF3A7192139A A5EA2E6FE63942CE 2F7F1D63179DE612 A3281221A3DE566C 2636FF546BE0E52C 15D44B68DADE2CB1 65B287B52E5D9698 FE0D497E1DAEEE3E 4E72AA18E338AFC6 8845573CAB3EE95B 3F922EDBB035DF5E AE44A3356F22CA9F 3A334BE8B71AF055 65F5EB5EFE3DEF6C 583CF0829B86B39A BA0290D5B8673519 EF61DBBF333A83AB 17F74435C2F7B9AB AF338A063DEB68BD 122AF24D5ED8A083 1274EC43DB3AB30B 28A5A40BDE77F1C6 43F97E96A8B1C11F 88A87C6662AD9F64 059151203839A660 FCCD42B196B8B6CA 4351FABEFECF4C43 92E0155991C363D7

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050543 (name+title). Key = MD5(password) = e757c0d3ad49eecfb1dfc640ba8bbd66, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e16ce8fb-537a-477f-b943-ac00704d99b6
  2 4802d48b-2ca3-50cf-a354-a5216aec36fa
  3 c2244758-bf15-308b-98cf-44a7cf2a30cd
  4 f46ea8b5-1624-04db-a873-ac62734bb434
  5 01b87044-f04c-2cb8-aec5-0d9e0a068dd1
  6 556fec1c-5cc9-796e-bc32-13b94535aa20
  7 d02fe1f0-06ed-83aa-a770-552a9261498c
  8 edd33e16-a17d-4876-b45d-137e0b953828
  9 9b56fc6f-cfa0-1ca8-b084-2f90f5d37f7a
 10 668e0bb6-562b-3cd6-8bae-258275a5fa15
 11 e3902341-c4b2-1765-ba48-c17a3a8d2fde
 12 263854b5-ee80-3896-abab-aa11dc22c45a
 13 89f650f1-3227-0cfe-873f-863d79d93af4
 14 2ba3f1a4-e07a-84b1-ae73-0356546be34c
 15 ff1d809e-9638-1d72-9c3d-a6f9a1a2f0b1
 16 73e64eb2-8803-616b-b887-8f2d19e47079
 17 06765e9b-0d1d-76b8-8a9e-ff6fb863bdca
 18 f73567b0-9e2d-8a92-ae97-3dd1e3546ba9
 19 49c1b885-d9e0-38c1-88e1-2e2ca4dd0b22
 20 a9ae21db-53fc-778d-89b9-17adecebecfa
 21 7d2987d5-a87a-56d8-889e-5aa0490b18fc
 22 a35c98d6-8a8a-8f76-93af-716dfc00da30
 23 b04b1436-ba36-003e-a1de-51bdcdee6e5e
 24 fb53cb1f-05c9-2928-a6b2-30821922c146

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 453027841313081678375802. Exactly this sequence comes out of new Random(616).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 221 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related