201210061204 111n9c

explained decrypted filler

3DES(name+title) ECB, 20 GUIDs, seed 188

Metadata

Post ID: 111n9c
Title: 201210061204 → 2012-10-06 12:04 on A858's clock
Posted (UTC): 2012-10-06 16:04:15
Timezone: UTC−4 · title 12:04 against posted 16:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210061204) = 1b94a76c45acc6968cc9e0b2cbf85f83 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 20
Filler GUID seed: new Random(188).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 312 · predicted N = 20 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

852B6FE13C50BF65 78FA0876BA7971C6 DE273F9F5AE7B97E 676BBF832B3C19BB 5FEE5729C0ABE185 8A7E40F3EC7F3CB3 E112E8A202C59340 C69C888CF8F38350 BDC2C249692F29DA E7E7112A3775364E 43C8A3B6252F76B5 0EB65A1CEA0C16E5 27087079B7821378 8F57A77EEAE9D8B1 2C91D3ECC772CE82 60E2648CF516EC8F 1D708F518A6838EC E3693D564CD225FF 62B31CAE32793112 D961B766C12EFD1B 03FFCDB003C01252 E65C76146447C6AC 34FC868582781815 41E0AFF1172AD49E 816D54C7DAEB99FF 591DB45E7EABC37E 299DE6EB1CB1F8D9 2948854B2AE965F6 179A3D0CA10BDC98 62C538B84F614970 BB0A75C6E21CFEC4 7595E0AD898112FB 86EA735AF7C9A438 A88AEB8961721AA1 79C9D47B6C96B7ED F7214AF0821589DE 0459A9CAA750B238 30BFE7F2852F1493 53B48DFFDB17540B 944A39074F817447 59E28B466184D18D 7C8C8E4E21EB62FC 7C8BE6C9E3D4E14A 9AC203A285BA510C 9D377931723E4F97 901805080D9597AE FF443378A7451FEE 3C3BF1BCF337BDC5 2CFB13B8A76914AD 6A400FDCB2D66083 1E704221BFB4666B EF332E2621F86F88 A7C1C14BAC20E6BC 7BA750213CDFBC17 CB0C5F75650AFCA3 D7D9C86D1CC8C352 2730A7BB115517EC 4F155DCDF0F9D494 004CCB11F1673C10 64B2C564E1D1942A AF212A45C52F7522 D943440E3D7D4A2E DD29EC07D722E624 033049C55E3F7B92 8466BF73A0A3FCD8 6DDB3202E81EE4B9 E5C1642729D97C07 1309D6AAFD67A923 617F13C19D9ED2C0 2875CCFA67560B2B 02C0231231BF100A 95F1C8823A9D5C0B F7FFC9AF71476A29 FA09FBEBBAF9E7A5 D8568F3FCD1CF025 AD4E4275AD0798E3 4E7CA47FB64B4E44 3BA721B0788E4F92 8407B3B061C0B91A 5EC046F635A7B2A0 A3F0288F6C3D6937

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210061204 (name+title). Key = MD5(password) = 1b94a76c45acc6968cc9e0b2cbf85f83, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ea3d0a48-0dac-8cea-bdcc-a23aa16011ed
  2 99d7596a-2d14-8c36-804b-d161217da91f
  3 4bc8d520-3597-11de-9407-7fc95fcd1779
  4 a3499f1d-136b-6c34-8a59-d6489265266b
  5 314af694-9ee3-01a2-b6d0-c25b6f53ca6a
  6 1c2b7265-be9d-74a9-ac03-d53de38fddfd
  7 0b15581f-7250-1786-9110-20f32e7d59c5
  8 68d6cb8f-483f-6b18-812e-896caea5fa5a
  9 685961bc-99bc-27a5-bad9-b8b2c01b47a0
 10 d521a6c5-259d-5f84-a3d3-259a9b9229fb
 11 3228d2dc-94b3-7b70-8bce-6eca60abe060
 12 3599c61b-7544-272c-9fd3-3defad607eea
 13 d4305640-779b-780d-aaa1-c80328745666
 14 a47c3995-ce9c-2a7a-921b-464d250e0c6a
 15 9339ddd4-4abb-5eae-9735-aa8b9a0656a9
 16 9a51981e-e4a4-30d0-a8f4-9f1b0a7353fe
 17 3b6dfb30-2f46-881f-90e2-720960fb39ac
 18 f8d3a007-83bc-433d-8b6c-084dabdd80b9
 19 a0af7488-06d5-6da5-8b1e-7d6d1d9dce14
 20 4c503580-d2e1-07f9-8113-3faf23762fb7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 88160716257272538460. Exactly this sequence comes out of new Random(188).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 312 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related