201210062104 112gn8

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 725

Metadata

Post ID: 112gn8
Title: 201210062104 → 2012-10-06 21:04 on A858's clock
Posted (UTC): 2012-10-07 01:04:38
Timezone: UTC−4 · title 21:04 against posted 01:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210062104) = 1aa394d73db6e150e6b0eb93ef983640 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(725).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 339 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 10 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

65C4D462A3846B9C 6B2A5A8448483B39 082705989B6CF362 576CF5F82EB84D8C 75681778B128F322 A700DA3D308B4F39 1D223F8E49F1CD14 4B798A0E0E153A60 3BA31DE9105C186F F2383410AA30B12E 978866F5A6449C80 66C9BF1BD9E37367 5AAEB04448C7F8A7 B894CF51A1430842 489F74C63D09CC98 7E60B9A1CD9D288C 4A40EC39FD1CEC88 452635890356B141 CECD3515ABE4F1E8 D615C1F88026F75D 2783A4FD5DF5A7C4 B7A0C3DBF1101623 815E234578CAF094 28E29D4057547163 77D91D1A71489F48 7FFA245B52F9FBEB A08BC17B226C46F8 E6D714AD66B5F905 E0F6FB8ED49D75C9 89C228AB6664351A 1D118194E913045B FD0B5A356E5CBE07 0302D8700A7E4A32 C212AD02FC896294 338178BACABD9951 FA1E36FB2A2E32B3 52276F6AA98603EA 16366643776767EB 64D96CC7EAAB960D B2FECCBD6310DF20 C6ACB96214F6DD4E 7A9CFD8EA7121E09 D345689AA10A6564 BCDBB5E5F42DCE0E 35E0DD9B43DFC1ED F6E0F83439E32CFE 82BFF1BFB5ACEA0A E9B07E4C9B84EC09 EA991D03EB9966D1 E2B8736C29520DD5 A7B0DD59BAD38B40 D04E9556A358F77F 1931142CB46B3EB2 75A9FE577E57215F 4C5AD9BD5F92654A ADB6F37B0CC77BEC B386DB49026E8639 BC7B48D2988D924F A77FA69B4F48F34B 2E14C08142555AAD 2862514DB9A951E6 997F19DC3A599C2D 8446898A617AA709 90A641AB1C80C78C ACA76514860A0FAC 5C2CCB501C24A659 A0600929DF02CB4B BC494D75DF505887 71F645C7A3857E7C 2396D0A2CBC27532 82DFDB333E457A03 8DDCEC74FD458CE8 55D882FF28F952BB

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210062104 (name+title). Key = MD5(password) = 1aa394d73db6e150e6b0eb93ef983640, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b727e758-c450-42d5-bf45-a04e190fb210
  2 38f6b773-f2f8-44b5-899c-e982e8b9dc52
  3 8e4b6850-acf8-4d24-8094-86766a6678e6
  4 ca1fbcdb-d91d-2972-8272-868b5ebf9fea
  5 a937c82c-1692-4a6e-8a3b-966029d22635
  6 2a5d5bce-c47d-1846-9e20-56aee9c59dfe
  7 94163fba-19b9-651c-a5f3-152b4e84b176
  8 5280760e-35d7-1ced-9d0d-54d2a022aa92
  9 5a8287d7-e747-6aa1-b6ce-04fc91d5a59a
 10 941eb30b-e5ad-5368-93d2-b2f04dd598b7
 11 6134f71a-654c-3d68-a968-1095a83fa87c
 12 4faf1fd8-0943-49bd-9bd2-4844f26adbc1
 13 b13cb82b-3a78-0def-9e21-d56d8eff8ccc
 14 87c40961-fe37-5218-a8af-3ffd0f9e15b2
 15 1aacfa65-12dc-4887-afe7-b26231729591
 16 b3311a91-2c50-74c5-a7b3-c5b401c3acd3
 17 7a2fec43-5f80-5b1a-a986-2d3e2c8b5f7e
 18 c99a7f6f-a628-4f2b-8de8-c7566bc9e659

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 444241616534054754. Exactly this sequence comes out of new Random(725).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 339 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related