201210080225 114kpl

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 78

Metadata

Post ID: 114kpl
Title: 201210080225 → 2012-10-08 02:25 on A858's clock
Posted (UTC): 2012-10-08 06:25:47
Timezone: UTC−4 · title 02:25 against posted 06:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210080225) = cf322153f052187c903fc0f0ff274368 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(78).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 427 · predicted N = 17 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E651B7C7289BF9FD DC612395181A8D93 CABEF361DD6A5C25 2E2FD652882BFC37 C3234E8D11ABA3B0 DA7BBE9F1D211A02 1D3E3A37B0DF1E5E 392ABDA2828880E4 78DCC45DF74D3804 700DE79F152F0540 CD0F5CD47494ABD4 23CEC69A7C15B8F1 1F97772EF23C3891 5F6149A425836E8B ED3A1DB46401C58A 412FCD10CC621EB5 53E6F6DE5EFC3D8D AC5C3A35C593B6DA 25A0B4EF4E576282 411CE1EACB7D8D53 7BBBB14419F0B183 23D83B0D54580EEC 6315242970F79131 C44CB7B3FD538156 9AF3BDC46B29B8EE BD69EADD47E96E20 C0F0169360FFBC27 22921CC3E03ECB93 40E86AF1540A1F51 BE1AD2989659E055 7DED5D3D30A0B041 4928925F32A4BF33 BCEA8E6B1185C6A6 168CD5D43E42FE37 489F9E831F13DF69 F0EBAA00206EE051 DFE8DB2C9974AC9C 09A006D332D5E82D 32AB13DE5DAA98B8 B97A2960C91238A9 B2F4C45EBB454507 992A07C2BC5BFA80 A9452E8372A201DC 0E05A4CCDD1CAE6A 293A3263F2D0258F 79176B353FFA2CA5 AD781EC639F33A7E F46C196CADA8B462 9D5B4212234F77D7 A6B014289DABB58C A9731B70C9BD63C6 D77DFF2457778601 C971E20C08DB4794 D1A9B7116077D7BB BFEEDF2CA719ECD8 FC33D781D5860D5B D55F6E7BF6E0B1B8 B7DFA0A1EFE5BC7A CE918516D49DF7C0 2FB65F60ABFE4EB6 883EF6B30DFB91FB 4D4E36D70F0B4A79 64E7C723039754AF 4F1E237258DCD761 DEE62431B16D6304 8D5871D23178F0A3 990E7E546600DE01 C192558C8A2D3CB4 A19520FB74D225B1

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210080225 (name+title). Key = MD5(password) = cf322153f052187c903fc0f0ff274368, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b7fbc545-4cc2-4400-9747-420cba2ac0ed
  2 460cb9c8-bc88-608d-b713-5fb23c9be3cc
  3 7e67a76d-9b26-2132-a816-c7f3e96e6c1d
  4 a6d2324a-fe47-17da-bc5c-9655b35251ad
  5 ed1bb0c5-51c2-3b53-97ae-8ec5da0350a4
  6 e5f54a16-4cb0-68b9-8513-c6b9d43dc040
  7 abfd3a61-48ec-7d16-8d48-3e3694fd9e64
  8 691f4937-38f2-5e04-85b5-dbbabeff0b4c
  9 473b49ba-78c0-52eb-953e-4f031fcf036d
 10 0882112c-3cb5-02e5-9711-57a581e740f5
 11 083c25a6-2584-6f7a-9315-0527bce8daff
 12 1843cfd8-c137-3c31-a7a8-492937b6a06a
 13 25f57b7b-7e73-24a2-b8cd-e5deacc8c8fd
 14 94f6cadb-c39e-067d-9669-9ebb9c026fc0
 15 e0d678d8-2557-58c8-a5bb-08fa48126c09
 16 e5fe9452-3d18-6204-a880-8509c48c66f8
 17 ad5421dc-4637-5fa4-b873-02217341f46e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 46213675506320565. Exactly this sequence comes out of new Random(78).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 427 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related