201210070745 1131l1

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 637

Metadata

Post ID: 1131l1
Title: 201210070745 → 2012-10-07 07:45 on A858's clock
Posted (UTC): 2012-10-07 11:45:02
Timezone: UTC−4 · title 07:45 against posted 11:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210070745) = af6f33d036dc2d9e61fc752c96d7bae0 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(637).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 371 · predicted N = 18 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 16 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8BFB19997D62938A CA1F4856A08EB03D FCD94A06B7FE9C78 01C8E73A4FD43EE8 B30218C75CDD4289 44723199F9521F02 8AF6E6DB6ED7DCD4 ACABA89A259F5424 C724453FC84FAACE 9E474B0A6C9B35FD DC18CBB86436715A F382D5C921FC58C2 F3FAB24BA2DB0F94 9979BFC2EFE98907 E8EB2AF9D4EA924E ABE9F280A1E1E574 2CE7640DFD868AAD D4D436D3E5CB3332 FFFF1133EC56A2E8 D50BE76538CB0729 9519F0C63405A468 433B1839515E3041 B4C14C6694F63293 B808D7F9B32EDB5B DEC8F383BE8136D6 195C32CBFEB04A73 A997FB1852359FA8 1D3CE7B58923EF93 C2124103B094AB8D 78685212F5B8D1FC E2240D8454765911 897F4271515FBC7A E78CF0155BD7CCA3 9C1A7A9260369FD1 154E0B8D30714F6D F49D95E2124BB683 614625A6E044EB99 DE2E11147A1E0C03 978B3B7D46857F63 02350D26AECBF401 C8FF3387FAB837BB FC599AD1EF054EC2 394C94BA45972824 3709A62BDFF5BE12 7F4FE80D9829CCDC 005AA9072979ABFA E559FC3EB69EB1DF 94246CE93BF599D4 C62E10CC47535F4F 625F8B8CDEAF0BC5 32F1B3E55D657BCF 6EBF542097514446 F209AD69A3222F7A 94EC8C3EC35EA5F1 17D8F6A1E142B139 62D6BE1736CDF2D6 5A43786BA51A41C4 05B545166F9F0EA1 ED0B6FB9943D9D7D 4421E5322DC4134F DF1026962A14D624 FD9BFAEAEB25F7D8 DD85A5B16EA24FF2 36D7FDFB33619C89 10C6B62C69C03CDF 2B8C4715FEEB3E7C C719B4FB697108C8 B0EF49EA9CE2D36D 3CD8F30CD7CCE20F 8211CA4B5A7DCF38 8E6B143ED761DD48 259F0F1A77F0B88B 0100E6F8A12DF966

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210070745 (name+title). Key = MD5(password) = af6f33d036dc2d9e61fc752c96d7bae0, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 43154f44-a7e9-4ff4-95a1-154cf3f483cd
  2 4418fcfb-d1e6-6eb2-8b4c-23084fe9622a
  3 c7fe823d-875a-07d0-964e-e34f58cf3905
  4 79b130da-901e-4ae5-a6f1-bcec3930cd71
  5 ee26ec61-32a9-7a0f-b4e9-20cec27a2063
  6 7d7a1c95-9ba1-2645-b5a5-087bfaaac2bd
  7 663a9b57-6abd-277d-8b51-a4a58c33e370
  8 348a2533-9a67-0fbb-9aaa-eb0a0f809db5
  9 97079c5d-8684-76af-9353-df548e26aed0
 10 07a09de3-c77f-1188-af41-70a62618f662
 11 2b7e0a7d-72a1-52f6-84d3-4d3fef55fba5
 12 e314dbb1-8971-722e-b2aa-c9d514810b55
 13 221775c5-921d-489a-8ecc-08e78a506cde
 14 bc623ae2-353a-752b-be16-c997c68eb322
 15 56b9de1c-cec9-71ac-827e-a023fff63928
 16 9c79c789-72a8-7e29-aa6a-ef8238d6c96d
 17 e8034b74-72c2-5e43-9f12-88bb2d4e1e11
 18 5731fc7c-2569-837d-a922-2a0a6aeaa0d0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 460472207157477758. Exactly this sequence comes out of new Random(637).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 371 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related