201210080625 114rf9

explained decrypted filler

3DES(name+title) ECB, 23 GUIDs, seed 373

Metadata

Post ID: 114rf9
Title: 201210080625 → 2012-10-08 06:25 on A858's clock
Posted (UTC): 2012-10-08 10:25:54
Timezone: UTC−4 · title 06:25 against posted 10:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210080625) = c47524bb50efd644e8d8687e7499eebc (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(373).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 439 · predicted N = 23 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AC3E7F644E211432 13C3674CA8C8EA44 C5DAD5D4528E293D A7ED8F1A67E36362 5C855C66950FCC4D 2C4C4CB11ABF6D4A 51BD81372D7A1A78 95B8725D5E264C4F D89282C4CEA14A16 36B3266DD953FB5D 8141573A58D31701 3A63ACF19769A1BF BC4A3020C59B0AFE F7B01C4BA2686894 4088AD526701843D 1B931AB4E72FA390 76CFCCE031D303F2 56164A9D400E190D CBDE682FF66FA570 D26FF261D828057E FC6DA8E63A2B0992 F11B86865C05881C 15770060667A537E E6E312FA99351889 B10EBC024727B129 DDB8DF003B4A0FE6 81441CAA6E4D7763 8352808BEF896EDB 70F0C3F979CA6242 966533028BA5A800 E9E57B4633A56715 3AADFE633204D67C EE650A15E94E3C1A 5BD350BF8084D62B 7F0EC10A6A60C71A 00DA33BB0BE8D424 2B277D4FF9131294 4ED7EF5C57713A95 E16FA8353559D3F4 0A65028B502089E9 1EBF390A57DC878F 648589DCA4FD0DCD 0F060231E2C48FF5 24DD829060D9ED0C 4CF7E0D2539A3C3D 0D6E38144BD90AE6 C0D8E81C0CA786D3 E80A5989D2E4C17A C357A9BF5E6B4230 C8669FB268871F00 8EE070BEA2256F38 6A7FEEB5B0B7781D 15E39257F9079DD3 62AF575EA470E102 3B5A00237A4AFDCC DA81E0C0D16875E3 6A62E2F2FC4FC3F1 07E13B8071A2E966 86027D28FCBAF40B B07CC34D78555312 1BA568BF9F9E88ED 4A46D411D3740E73 FF364F35DE20A5C1 243D6AF82A164430 1637FF5EB67B9DD3 891A1130AD9A64BF AE17B3CEEFBEEABE BBFD23B7CCC4B69D BF27C953B3CFE27A F17E0EB9DE63F9DF 3F31435E1580FD6C B5F10C6585E22B16 E102972C095DC52B 1831D57B04D3CDF8 5DD4F8DAD28B9BC0 A8E538FCA93E104B 2F299DE761CA2096 D7B656B81C45E01F 649654757DE31785 F8BBA97A8EB72A3F CCA6533FED9D4343 4530A39B66857D66 B7A85F01853F7875 1BCD829ADDADA58A B4909F142A03B806 B3095C889F643B36 D181C867CE25DC84 FD0D50F20D1CBE33 04BFC3BB80616106 E88FB236148908E9 29CA01BB4CFE7199 547A56AE64D95CF4 0CC3998E3DF65F97

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210080625 (name+title). Key = MD5(password) = c47524bb50efd644e8d8687e7499eebc, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3a0e2dcc-3ae7-5a21-a6df-fc6db232cffd
  2 d5517d25-b8b0-235b-bac0-c297398d2881
  3 decef394-9457-4597-8b45-2239deac42b4
  4 dff6be75-801d-197e-84c6-a6e13043a00c
  5 86f07d6a-48ed-5cfc-9b32-276a2d652faf
  6 5cbfb972-2a35-44ba-be9e-fd6f3f099420
  7 c255a64b-229e-00c0-879f-5946358d0df0
  8 e709c05e-c703-5305-aa6a-d7750eb750e6
  9 9daba70b-ceb1-1cff-8c58-00736d3b7fd3
 10 f475ec3f-5761-71f1-a7ca-e5ab6e9a474c
 11 1c6e89ae-e10a-0a8d-b36d-5533cb611e8e
 12 ec26dfaa-6662-6bbd-9c4a-abe5bce50c38
 13 b14b6162-55ef-048f-98e0-b114d9581aac
 14 6f40ffc5-8373-4cb7-8676-008f4f936a77
 15 cc14c2f9-cd15-029b-a842-75b33dbf43cd
 16 fa2687c5-9587-8aab-9ba5-b7de4b304767
 17 3e60fdfa-20b8-50ba-bc61-9c25a0811049
 18 1b2654c2-0b49-2503-a257-54fc05e52101
 19 e3a848ed-820b-623c-bdc9-ad58f0dd3ace
 20 5d2705fb-47e7-68a3-9f79-f972f95f74e5
 21 bed6f309-6568-3f65-a011-b3d04f619aec
 22 8e601335-fcc7-3c8d-8380-cd9439141067
 23 d41f1c62-c939-0e24-b9de-c523fc99f3a5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 52415405170604085266330. Exactly this sequence comes out of new Random(373).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 439 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related