201210081106 1151p7

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 974

Metadata

Post ID: 1151p7
Title: 201210081106 → 2012-10-08 11:06 on A858's clock
Posted (UTC): 2012-10-08 15:06:05
Timezone: UTC−4 · title 11:06 against posted 15:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210081106) = 23e5cd5037a1ef401a77e912dbf3fb3e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(974).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 453 · predicted N = 22 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3D0A6F3B2858021E 9986FF9E99EEE8F5 616B8E903D2EFDFB C4F674DF468D7705 24F5FF16990382CE 84E1D517F3C17F89 19C32ECA9505468B 520F86A27B06C214 F7C2A5663CD5B5DC 7D839A5EB84A5107 FE951049F50E5965 E072FF9D987D9467 40763D920619722F 4194C46D40165D3F 0E702BF0D9846576 8E27F12DAFE97A38 1854FE4CA7F35379 B68414D7B462ACE3 62F236B608DBFAEF E5BF6C54F85DFFD4 9AA5929783805DFC 24DE2E54F542A4C1 F00313C238F99BDF 67FA687C8E125A27 9CB443E066984A16 0AF04910197ADF9B A7BCA0E682272A60 6D092D630B804FEC 7F9AC804D9232671 14B13E28BB58D8C3 962862FB86C99916 99502CB5DE720B63 D80F60E8D80CF882 CF4B9C1E971AE63A 6B83F43CD23B98B7 DE59237D662B9EB3 648FC7A0D12C22B4 7C04F50E3944D61D 1DDE1E4F31A184AD 5ED34EC30DCBD1D4 3DD5DE700C853075 36A5372193D2568B 5F97B937C505CD5A D49BC6FA6C6A6F93 3C6788BF09440C4B 801E7169C01A65F0 B42F05FC9FD77D3C BEFB64309243ABD7 80E13C752021E939 AB3A1B2C0115D677 3B9E0F809D99DB2F EF15D1D3ACE65C6D F2E9061A201EEFBF C8B336C0BBF11D7D 5A84498AED65D488 C875BDA3C84DD237 0AE60FB56AFFB366 E186E574C78AC8D8 1220C0979705F52E 29121B3A3391FA9C C26939490ECC7972 9311263EB3F2659C 3FA5D8B5F29CA037 52E3369E44E96B57 E129DF97D5FEF678 7633CAEF1CB461A8 32BB6484EE00DB9C 419B9F8398A20910 49066AB70CA9BCCF 1E7CEDD06B3C6B86 D253017CB1EB636B 60F89BAF8C5D9196 130F2A25DCCA0883 1936D333FBE85149 A1C49AE83F795D8F D8D49DD78FDD07A6 0E02B7497CEF7134 CBA1F0214E766A46 9C75F2CD886804EB F5FCF6D6783134CE 47EA4054E5134619 7A2514F75BAABEE3 5802F99F97203308 98136B58E31F125A D7EB05E6E811E399 5127276EE2191EE0 61ED0287BC3F5F60 999A02690427261C ABD84235AD5DE799

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210081106 (name+title). Key = MD5(password) = 23e5cd5037a1ef401a77e912dbf3fb3e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2fa3b4ba-c571-5a10-bbab-04b18bda48ab
  2 7b3a0b0e-1f6f-56d4-8a95-e45fa935f688
  3 dea86236-ca9c-5dfa-b89d-195e7bb7e3a9
  4 1bccc414-668f-40a3-bd47-07382260ed3c
  5 40e43dfd-fdf9-8878-a638-ff3d2cc2e130
  6 4b443157-89aa-699e-9e97-2f8df5d8ac39
  7 9ddaae3d-1a32-21b3-937c-f20b641d8fab
  8 054b0e8b-b998-0c71-9103-d2f3c06a25dd
  9 06d9bd30-f407-403d-854e-b06fbb5cd462
 10 668b787d-cfa8-3caa-8659-598e996d7422
 11 e778c848-7581-71ce-bacf-679b37274bca
 12 d742ee50-034b-7d3c-aef9-9c4fded5f47e
 13 9a77770a-1ad6-1501-bd70-3abc54735ad0
 14 b545ca29-b9cd-15ea-b5fb-edf1149bfcc3
 15 f7f7f119-6502-6f6b-bd87-ebb42fa4d1f2
 16 ca7796dd-519a-2c5d-82b9-55fde7049666
 17 fbf1fa72-bea1-2c60-be88-582933477d48
 18 2e30be9f-e738-7523-904c-ed9c8c35ccb4
 19 c3c81177-bcc9-0598-85d5-98cc0ed7a893
 20 af90e8af-794c-43dd-9035-bba173103171
 21 26d3c84d-5018-2019-9f9e-630bee7d33a2
 22 9a72b42d-59a7-7724-ac05-92fd0202aaa5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5554862043771162270427. Exactly this sequence comes out of new Random(974).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 453 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related