201210050843 10zn3k

explained decrypted filler

3DES(name+title) ECB, 23 GUIDs, seed 902

Metadata

Post ID: 10zn3k
Title: 201210050843 → 2012-10-05 08:43 on A858's clock
Posted (UTC): 2012-10-05 12:43:11
Timezone: UTC−4 · title 08:43 against posted 12:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210050843) = 1acf237fa917c76262c23fcb9d53ba49 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(902).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 230 · predicted N = 23 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9501E7F28E239869 61753AAAA41E68BD B909FF3E5B461900 5592560485DFE2C8 22F14F1732A32C87 4867C51CB9954C2E B07A1D270A468E48 8AE131A42EC7345D 9CA79AF8A6ABB907 32AA1AE86CDF622C 089DA28638F38D16 9F7467AE5EA11DBB D0DEE5BE7071A044 FD9E9B670DBBAEF7 B0663DD2F288BB5B 377AFA62869D8C27 A6835BFD64664FB8 146D4A58DFC6EF65 89FD8A77CB0ABD01 85901B286FA20AF7 2A9A27C131EA68BD 84531E24FE1ED309 CB53F49BCAAB71AE 2A63B642F8A85BE9 28050059452EA5BD 3162B34D63B91C48 294938BB6AA7F531 6FC46CCB7B3B1879 1AA5851BF8345528 8C1A505BE01D97D6 9FB51A5979242EC7 9228794ECF76D4C4 197C5E908E5A9E84 C5D2AED9A14E1B3A 501AD212CB67F26F 3E0B900C35C1C77F 70607B7B3E956FDE 76D104DF1D4F55D7 AEA051A1BE4FD948 FA46191A8F24CD92 9B86E554D4E0DD34 08C2E5C03F3DF9FE C0CBFC0765644FDE EEB1B4259C5F9CC9 67884CA78F29C90D 54841DFEB6D5BF93 88769240C9625971 BD0A60CB2CC5F781 B9F8EE4EE1E0E530 5B60EAD23BD0F5E4 FE0204FBF951A6C0 DDDE4B757DB07174 0996A59451F746EB E9F8E2AD4DB2F616 0DB22DA774CE5648 B79E110466421AB1 6ECB5D6BF3696852 D52E834FA13D3D54 8C118BF926D7D913 C2F237805A4CA61A 8434382556BF6846 B558874E7CAD0B74 9C8C39C7B69555DC D888D5CC96953FAE A4723185584CB9E3 8F67C6573ABA7F6D 7B09A56DD5597C1D C5D0B30641A9340A 5A4B080A86E82025 6D6B50DF3281E5E4 B5C87E65EE0F7DBC E0EB35F08869D176 B5D29EB5026243DB A14110543B8C90C1 BE7EECEF1C1A678F 0175673EA593C94D 8EC1D7948703F512 42AB4181961B15F4 A5BAF7900C4380CB B877EE339B575C5A D53CE51B2F91F574 63BE37E5F4409961 A5AB667DFE02D48D C312A886E9A25F05 6AE2889FE4080BF8 7D041FE9B76863E2 41B8F63A2CFF3E05 536D7FE846FA22C3 2122C41D373621A8 C4E60B2F7FFFED66 030C7AB9C8E76703 10D0DA5BD4357F82 FB7A84DFF82C038E

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210050843 (name+title). Key = MD5(password) = 1acf237fa917c76262c23fcb9d53ba49, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 321006a7-b212-84ca-b8e2-0dd413024dc8
  2 7cda70b2-941b-4115-bb69-9f64226d9cae
  3 8ed85d66-3871-2155-8017-702125d23086
  4 1297838b-803e-048a-83f5-e854a19b96d9
  5 4f7ee253-9a17-4b63-9bfd-38d3a5a432d9
  6 0a6b6be6-907b-7aa8-82e7-20cbb0039910
  7 3d53aeb0-8fde-0e94-9a11-f4589714a047
  8 baeb6076-37d2-84da-8cb1-dc31169c56e1
  9 4e7c4ebc-a028-530e-a438-479201b5f016
 10 7aaf5311-04f8-7794-8e38-c00f92084fd4
 11 8a97c963-a615-71ea-8042-a0db9cfa811c
 12 a4350b26-ddf0-647c-89ce-5d93af907aa4
 13 1648eaad-0141-6da6-a9bd-677f31297b82
 14 4d3de261-e152-6c53-a5fd-cc423f1bc64f
 15 bbb34850-3a03-3366-bccc-4a395cb1a49d
 16 09aa02bb-ba9f-3bb6-a459-9b4fd1ecfd5a
 17 ca90a968-a766-0b20-a918-c2fe66505f98
 18 f44dc6dc-69a4-27a1-862b-d4a4c53f3388
 19 82964ac3-cabe-05dc-88cd-ea253b70f60a
 20 8a4ecd84-2feb-54b5-aac5-7969b3c716ce
 21 a107cf12-c6fe-5d70-9d46-ccf78463b024
 22 8598a330-fed1-1ef4-b915-e6ffe9724048
 23 c61d11b3-8498-3297-ac0a-1b29b898a30c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 84204708577666330205513. Exactly this sequence comes out of new Random(902).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 230 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related