201210062144 112ik8

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 680

Metadata

Post ID: 112ik8
Title: 201210062144 → 2012-10-06 21:44 on A858's clock
Posted (UTC): 2012-10-07 01:44:40
Timezone: UTC−4 · title 21:44 against posted 01:44 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210062144) = 4782e2653db2a16cfebfbe3a7cf4f8bd (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(680).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 341 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 9 · 3
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9B42352CD9000472 17E27DECA7BA9386 78B3E06CAFB80CB4 2C57D9DBCFB4B307 656559702E0B7D3F 5CE969DA0F81509F 32AF033330A446BD 1179195148335DA5 104BC79EEACE9C4E 748D8DF01CDCDA06 A5AF9A62B9A90CC2 A508DA89127EB494 3E2C2E2C4F829600 486E95E2B6CA1985 1AF00A72D4C98C84 52E6FA36689859F8 33EF12781F2C315E 7149355E7D94BA42 40D159C5594274FE 43F35E2807FAE70A 98FECADA60916A6F FF83A4015E3F5045 45571533DA3A8D7E 5E693CF60583A74D C1768AF80438685E 77FE3EC4BCB46AD3 114219143DB35C19 C8FB77BFD9EE1226 0BDFE96336230DA5 850B2B0CBA05FD23 5E1857F4E8E94F3C CAE1AF477F45ADB1 7311F97EC65A4644 1488643C3F16FAE2 9EB80713A1A1F332 BCDFCD2B6DBEFD28 E8B6275161193F33 D063830CD173C528 CA4BD1A31C074C2B 51215ACB0D98BD23 3443FD36A75D00F1 4E95AD6AD6CC88DE 0F9351DCC75C7379 18A3ED0A8FDF5334 0B75B627D9D1299C A55CEF414B5575E6 734959BA49993577 44EA3658F18FFB92 ABE6EBB74D162B80 52BCF7C0A6D6928E E740A02087C89DA4 65E9F3B755705F90 801935E8330269CA 3F72412B93CF7C50 2151CAE119A176B7 E9DA26F632492352 FDDBEAFC41B199DE 42F16905599B9EA6 40884D9B05EF3BC2 73443BEB82FFCE3D E776317684CF4A43 656351A4F95228D2 003D50B77C6E89A3 F1A582F0C5547CAA C5545D81320D15B6 EAE7D1E853ABD490 6769EA4D50F4BAAB 3F013E19E5C29803 7565878D4E2978C8 5D7634B84D461FB6 A19589B447276F86 552FDDA08F1D5F73 4744041E333A942C

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210062144 (name+title). Key = MD5(password) = 4782e2653db2a16cfebfbe3a7cf4f8bd, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4a2097da-86fd-84e5-b27b-a3f013ed9990
  2 62fa8e4f-b830-3fc1-a828-59e429d0b7f4
  3 0de94c24-78a2-0db7-9c3e-9e57ec9176cb
  4 62dc4d2e-7073-6d14-b69f-54a20a47ada5
  5 9a502ac1-4cbb-12ec-adc7-031ad125162c
  6 1bb222c2-339e-75bb-bab6-47dd494fae36
  7 3d7f8e00-c0bd-525a-890f-f816ba051d23
  8 281b43bf-9ed2-597c-8a19-5e23ee2635cb
  9 37b8bc9d-868a-07b3-baab-e940a996f7ec
 10 5840f88a-7f0e-06d2-9ba8-113929b8d933
 11 1604ea67-8065-2281-a1ff-bd8a559d57bf
 12 5ba8b9ef-3119-38b9-bdd5-e167f43a3d82
 13 c1b4cd3d-224c-09f2-af75-93abca137fa5
 14 e29b88cf-aa76-2b8e-b57d-ecc8baab969c
 15 513ad8cb-dfc7-8866-8ad4-090655862701
 16 65513850-2887-68fb-9cfc-3906a9e74dff
 17 27d69e8f-1dad-6f64-b8c1-2bb935d99cd7
 18 9bf5302d-f5f6-5bd9-82df-9fdaccfcb676

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 830617550023028665. Exactly this sequence comes out of new Random(680).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 341 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related