201210070004 112p4o

explained decrypted filler

3DES(name+title) ECB, 20 GUIDs, seed 126

Metadata

Post ID: 112p4o
Title: 201210070004 → 2012-10-07 00:04 on A858's clock
Posted (UTC): 2012-10-07 04:04:45
Timezone: UTC−4 · title 00:04 against posted 04:04 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210070004) = 204688fa7ba03a1b338bca153e0a9c14 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 20
Filler GUID seed: new Random(126).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 348 · predicted N = 20 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 11 · 3
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5DDCC0DF9649993C AA9586D1FF626225 9A12C63698E08B3D AA7EE2494C19E9FA C3647051658DA377 E38EE6B1E6654AC6 25C75948ABAA6DA8 0171954DA2B0704A 17F30F3CF982F76C B7AD2C66306225DA 8A5E36B93D1EA953 3DE618DC01B53C62 C86AA16041A7347B 98AEE6322672CA68 0BE18010D89F1474 6FEE536A5BECE249 F4D711886CF85D38 47BE4D0B34B01984 9EE458BDE88FE84A 8564398EF4375A02 669B657DAEAFB00D 21A8C173491BAE15 A17522379CDA57BF 819F918C201C14FA 47A5855D831F4973 1A0EAA9BEAD85451 CBDA8CCC6CB91E48 091F944BF9B31CCA 6E5326047F8571F0 11165D568505B09E E5EA53E4E3A7ABBB 76FC4540A80FE9F1 58A626C5636E4D6A 3FB8B877C8AF6B9E 15611AE8E0BE31E8 AECEA338499ADD74 33CEBDEE865BFE5E 31A44C9B0EB17D2D B21A8CF46A0D1095 6B9AA35B6A02F878 C479F40041E6F81A A2F96B13E1186E10 CDF8E7956D5CB5C1 ACDCAC6E33B54608 D91966032FC3478E C7779E1DEEF681EB 4F8CDE95271404F6 BBA0B2BB959C7B20 E540F76007CD8756 E13EE3BE591C0841 638DC1AC6F079DFC ACFEA2D4E97C5E65 DBC97E10AD40A716 E2BBBAF993189A3E A9F18C7ADD198461 ABA74083729B22C9 7F57DF3EE8DA2C25 F86FC62554496FA2 5672CE8B5BEF0E47 4D0B36FADD2BC1E6 96B65DDEC122F8D2 4004466FBBE30033 01364A9E008E2D76 1E1F09B7A52DE5C9 398DE8061E24676D 268F2406246C6569 B7AD0132FBD0A603 B5720FA5A4F19F4C FD8E17403D8B0A81 57EE3F19E64A5643 A6E12C548BDBFB80 17127C1919DA6F45 5233BD7088A5A2DC 7FE763391BC330A8 61D3EBD45ACAAAEB 418A628F11451266 9AF3E8FAF519CE7C 16746AA132B7D12A C2CC7B623F6EC19F 452B7CA082D26B01 3B6F722279545D55

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210070004 (name+title). Key = MD5(password) = 204688fa7ba03a1b338bca153e0a9c14, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 989b3fc1-30a5-4d29-bf98-d7a0459c24dc
  2 292536b0-5ff8-7886-804a-e2b66c7b3a53
  3 559c9991-b2c0-7568-844e-863d758e3a17
  4 e5d1a28b-e274-4b36-81a1-b4b2018b5248
  5 f797f646-3729-0d5c-87a1-ae950999e5b8
  6 c51ac61d-f555-62c1-b00c-6a13f949a730
  7 a9f6b041-8d4e-3816-b004-79a14af75485
  8 015f74db-57c6-511b-b031-e363b073dd94
  9 f3bc9d81-548e-52f5-8d6a-5f6939090c8a
 10 8fa35a04-e65c-639a-af94-5e99f32e8eb3
 11 c6b51d09-9f8a-1e1b-af38-5ba483ecd7cb
 12 3f2325ae-8961-7cac-acb0-2fff24d83d72
 13 c1eb938e-34ff-2984-8d08-46b24d2b21ad
 14 db05a3f0-465f-0dad-a5d8-ccfd47f8ee50
 15 108db580-3adc-1dec-a713-0b9ac776cfec
 16 c898f345-127b-6340-b2ed-cc6b719d3753
 17 7e52694b-3f35-7c62-b27e-de373db8f8ef
 18 a1477925-f547-1e2e-a8fc-9d3bce609261
 19 75c0dd94-d108-0dba-92bc-4480a66c3320
 20 5015dd6e-fbd5-03cc-808d-55c5aad82163

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 47740635561720167100. Exactly this sequence comes out of new Random(126).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 348 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related