201210081906 115x5l

explained decrypted filler

3DES(name+title) ECB, 23 GUIDs, seed 600

Metadata

Post ID: 115x5l
Title: 201210081906 → 2012-10-08 19:06 on A858's clock
Posted (UTC): 2012-10-08 23:06:33
Timezone: UTC−4 · title 19:06 against posted 23:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210081906) = 64b8f747ffc470530eaee9a8745c2303 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(600).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 477 · predicted N = 23 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F4F7D6F068C9154E 787D5B8C0AC968D5 E7F6FEA56F113758 72FC4B078B267DB5 73933E03FABE920D 79DE9C683F30703A A509BFC46FA3995D 97E56C638DE31F82 E825F88B19CF5765 57513FBF3FA129FA F7C82CDAF8210D9F 6C74E5A29D06D187 E9C72455C0FAECE9 417C26282469B482 49EEE5E1B71D9D40 A74F8F4F5930760A 275C9FA432ED3EB0 A37EC8E4940F6745 10374275B1754EF9 E34BB0935AD1F1FE F67C5DE49A8E6CC8 1033D6E607AA5772 02CC06BEB8EABDD1 C16C9C2436B79F7F 806DEFCC7579D0B3 E8BB1D8447BC7B8E EB029F9C47870625 263EE1EC17560D5A 02F6D75C539DFE1A 75AC1F447F235619 126B053EB3C48787 21DA41482928FF88 260CF2659C8C2FD9 4098B0EA02AFDD49 8EA4B6781B8E0C78 C239083AD7067B12 71AEE37164FB2D66 71D7CFA906D60E49 7975AF6B680633A1 452E84A4DCF6FF74 BA3D43BDB34EB770 12BD1E5B2BA56FC3 BB123F3CE1135FA9 568EAEECEBC36310 CF13D8C24222DC35 A6BF77C3178F2A80 83F4C2C3EAE181F7 D31FEF9D2B2E74C0 0041D1991152E0E0 0522D07DF5416711 48A08C3FC029DCB4 169702C5BBC624C8 7C892AAF6BCDD24A 7058EC4729E7AA8D 8B7376F8E38DB810 FA102B47BBD3F68B CA8D761A8E74014D 2C272AEBE4C3823A 429B8AF4637735DD 73E9251A7908F772 86A25F509C598965 9E1C1D68A8B13056 42B6B63B6CEC962F 68107F21D989FE1E 5D73528B203109C2 C37CE446EB2B1151 64352CE9617C8E7E 04D79E3FAD284641 3548C8159E04C0F9 BE7C9EF51BEBC0FA 7DBD10037F9406CC E28526E1CB4DAE5C 5266C422F2E34285 AE303C3F3BE4031D E6FEDB146633F97E 25150DACFA76D87A 74749D5C0F377279 182793278E37831F 84125B5C9669DCB6 73D2EC3413E02283 9E15EE2E123A9E52 4BCC6A2AFB92CBBC 01039D39086E3A11 06A24BFD79B8C821 91A7CA98A659CAAB B9EC61BD9B5300FA 65657E8EE8ECDE21 AB889DF1CF55095E 3D9C808F0A93A05C DC39AA7955D72FFE F4F48241FC856B0E 68E33E81AD4BD803 3FEB338C941A4827

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210081906 (name+title). Key = MD5(password) = 64b8f747ffc470530eaee9a8745c2303, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 065c4094-dae7-10c0-89db-fbb4cdf66a12
  2 c1f19a59-3712-7f4a-b639-d3220430e117
  3 42eb6545-8cce-12ae-8e00-2a9b35558525
  4 1c3114b6-76d6-57ac-a9ed-75786ced0e10
  5 c56d0942-15b6-049d-904d-5808d47be1b9
  6 bdc56aab-757d-840e-a380-f7e966920eca
  7 af22849d-74e5-681c-8925-2615848253f0
  8 bf6fcb44-23e5-48c8-9644-9f9700936995
  9 d024ee56-fbbb-1351-b6bf-2b7368704ce6
 10 003b96ab-c57f-4485-8d0f-e8d5e17d7e03
 11 44117505-f9b5-2dbb-bec4-06dd22add771
 12 e303e0b7-57ef-8bff-bbfe-ea185a30b853
 13 7f9d8c3e-83d5-0100-aa4d-63a3fd6dcc2d
 14 e59d6a9d-31ca-53e4-877c-d60daf181f86
 15 6763bb6f-8b71-886d-855f-bc6ee44e404a
 16 df1ff778-9eba-65db-9297-9b014082fdb7
 17 4c44569a-90a1-0cc1-ab8d-7b4b2aad1c68
 18 5eb8b357-d454-8c07-ac24-4b2a9e4de683
 19 ef64c4f2-a564-814a-8b6b-5564577cb736
 20 262b6f4d-080f-5fb1-bad1-779c6ce2afeb
 21 1f6e827b-42fc-413b-a2de-ec62307b7a92
 22 31794097-c2ad-0b7e-be54-32cbf55b9011
 23 8e507aad-96f0-3e29-b1f0-0679ed3fb208

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 17150864142805860885403. Exactly this sequence comes out of new Random(600).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 477 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related