201210070524 112yvh

explained decrypted filler

3DES(name+title) ECB, 20 GUIDs, seed 245

Metadata

Post ID: 112yvh
Title: 201210070524 → 2012-10-07 05:24 on A858's clock
Posted (UTC): 2012-10-07 09:24:56
Timezone: UTC−4 · title 05:24 against posted 09:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210070524) = 24d387174cf91e31f4cfbd43b0bd40de (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 20
Filler GUID seed: new Random(245).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 364 · predicted N = 20 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9178E0FAA1C2BD04 990465801BB0BAED 808401577C5F1AF6 6B7EE2AF7EC1B492 F74085E6E3A05AA0 0D6D058FE1D69EB8 1BB3C722A586C35D DB8D9AA2A818A7C0 64ADCEA93E9DEC73 4E2E022DCE96B6A0 7097A59E83DA2942 9090B47883DCA5B6 995E15D8AC39C740 D09416C23F117986 DE0BB0F37677CC30 4B25141A1DDCC970 01304006D7E75A4C 7253C917DAB053C9 75DADC265C6AB811 1FD6685BF02A2B47 783E8AFB365E2728 47854B4F181F4D1A 4FAE28669FF4BE58 4B20A908B87EDDD6 C32AA1FAD3BF1124 6CEF7BE7ABD36B0B 3015FEEADCED29B3 411A477F968027E1 0BD9A08754C1A69C 9EEBB3447C97606A F0F49CCF37AFC0A9 4208C02FB959A14B CAED5428620152E1 1B736AE380B9A4F8 CF85206FD8BFBD29 6F7C79864536EE94 7B3F8B20C15E3987 CE83BAA91F3D5F52 732E330F1C9C6070 59726C026296DA9F 34A08C99924F1272 C2F2D6B1F3088F4E 3F796E8CED4E0322 BFF5F9C0DC17D9C2 25F3712029727D3C DCE953AFC2F500AD 7BCB9820F664905E 36DD10673E267B21 C45964CEB1981F68 DA919B01C0B3B0F1 834A96DD878073CF 0FB0BD903AEFB98E 3D1A0E59B07F8573 C8EE6687F44179D9 DD4D9EF2A5A69885 D30A8E83B701D925 D6B48256851FC423 E35AD5FD26AB53F8 B0C477E18249ED44 5FD09AF35E3678C7 82531406E16F2960 1307100FBC83445B 47E6828C70696285 91D37D92AC124C1E B7CF3294E245FC6A 1DEA46C2ABC4244F 78A341037046728A A67B81D1B54BFA53 99561200D622BFE0 E06A2A66FE706B1E A03503B61DA773A7 EB1E4069D4D086BA 49B07177D8B06053 6F6A6FC01CD16710 2435A9F63AB30413 88915E31249D58D0 692325489933A932 D213B3401BE45DF7 575C4E88749AE850 0BF061780B072A93 0AB55FAE7792A884

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210070524 (name+title). Key = MD5(password) = 24d387174cf91e31f4cfbd43b0bd40de, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 621482d3-c1d3-6dfb-b736-366f23bb50a6
  2 29f9efb9-63f6-64f9-9462-873c47c01e7a
  3 67506217-9123-0842-8de2-a1bc10ba1484
  4 8d5c1bb4-b0a6-73cb-b2ea-04b097a652b8
  5 f9e7acbe-7e2f-7303-9093-c82e5f24558d
  6 e519a540-fa72-5572-8a18-9aabcad183a2
  7 c4522eef-e715-6ff1-a309-55252fe07b49
  8 cf619268-5f5a-332a-bf28-a0b3db377155
  9 f2fd434e-1e67-2fb3-b587-4e2758821cdf
 10 30db1015-b3ac-5a7d-a159-ed01068be962
 11 300bbff3-4015-7c96-a99f-deb2d42796f2
 12 a27922df-793d-6f2b-b8fe-427d18d2c484
 13 92136173-ad1e-0b61-ae0c-92effb64b777
 14 d185066d-e081-898e-a91c-3fd9ddf01bdf
 15 fa880f8f-b784-4c39-a87d-f5ff6f732560
 16 3ab45c91-72af-0b1d-ad26-ab0be3213af0
 17 7fc6e7d3-3dd3-7da2-b8ab-b15f3fd50b5b
 18 60ec1448-10d0-80da-801e-1c64de62852a
 19 9d2a6a17-1892-2060-b930-ad9948f62014
 20 c5853bdc-3913-10d8-9486-64dc587b9159

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 66077563257608407821. Exactly this sequence comes out of new Random(245).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 364 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related