201210100200 117c8m

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 102

Metadata

Post ID: 117c8m
Title: 201210100200 → 2012-10-10 02:00 on A858's clock
Posted (UTC): 2012-10-09 17:00:10
Timezone: UTC+9 · title 02:00 against posted 17:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210100200) = 399bc9539487010773164cf48162cb4f (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(102).Next(9) ✓ verified
Run: Run 35 (seed 854,622,578) (seed)
Draw: 507 · predicted N = 22 ✓
Machine boot: 2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9DD9FF53C55A880D EA3E72444C77058C F97E456CEF25B482 938E49D9B364B0B6 E12703FB328A3115 37A0AF07CDFA82C2 1BC4723F979C9A4D 23C8094C97BC9C53 450A6E6992C4EA93 533F9B7490D71354 47CC99AE7446213E 04558E29DAC02B5F AC68D6A07146C5D6 A6C5A7D9BF4030E0 EC1D7BBC285BA4F2 8EACF25E93DD26A6 542E7E866AB66E83 EDA08E8266832E95 111DA4D1F90FF5E2 93AA1238F7AFA6FE 954D81DBB0E6729F 3DB15DEB54480EF9 CE16F918F2E0A816 371680B618F9C326 E83319025A6ABCEB CE3F4459BA1A902B F6E23454339CF640 3BD3DB750AE54B17 A67FF54A0EDEE875 4C196A622AC962FA 7BD67AF8416278CF 338AD32147EB8277 DA7249C12FC5DA34 330FF6D7AE62297A C736C6A138B6C1CF E1AB4FC316E86048 75FD1D86FC0B5D3E 6C570932582CE907 25028978BC32297B B21E111E149CE770 B5C3F900028FC822 048ECB915DAB2936 77138E5D35D3182E BBFAABF03EA4641D B545AEE931B60268 036DC752799F1978 B7141A6D2508F885 1C515DA79AAE2BAE 72500408AA8D6D2D A4DE7FCA5F58EE2B E71513C7084C885F E6951ACBCD89A24C 6532C5CA519142B0 79EC551B8E8ADE29 BBE728D74F5929DC 47FA2EA0851A04D1 6B1CA842AA6016C7 CF270886208F2E66 B95327B544E02142 B1735F7F5E70F4A7 837CBAB37FBB183E 687ECF32639C2F24 B0B1F95AB671D692 01B6692F60641A6E 0D5EEEDD2728C7E4 B296B1A47A1F4814 107B7D11DB5B2370 1A6FBF2367960B80 DB7F5C289B32F95B 833E0D321F6E7028 8E3723535CB94F59 F5CB1A686A744BF8 B07E1514E8170F05 3C7018A824D3DDCF 222FDF3F49F8B1F7 D8D534EAD731AFCA 9DE3629B41306708 928627A7F517EF02 A467ECCF934A4F12 FDA948E2743FC533 0F9C1AE9CB39A872 BFEBD31161966C40 32CDC93CF646AABE 6C22BFF83B22B8CF 9142232A3A832186 2DFA76C2253D52D5 679C56B4DCA8A8D5 24DCFBE26119796E 9365CBB38BC79C7E

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210100200 (name+title). Key = MD5(password) = 399bc9539487010773164cf48162cb4f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 629345b1-a023-0adc-8886-f57b557d6db2
  2 df90876c-a408-6455-b0ac-9f51f267bbe7
  3 fd9fc4c1-7548-09da-b7d6-f046f4ac65c2
  4 e0c8b65e-8fbc-254b-a9a6-5271ae74e6d0
  5 40db4e51-706b-2e55-8bc1-4cbaa43626a6
  6 840189e6-25dc-6aaf-89b3-639dc3db8818
  7 dbc64a6f-e974-52c6-b698-68510a035ea1
  8 72170fbf-87b0-5f03-9d88-dacbb6e48294
  9 2c776369-f791-5e1f-8245-a4c1c30482ef
 10 b9092da0-4145-7f14-aa61-6b613cb46c05
 11 849e6cc8-f01a-3f31-8521-24e2b9bf3186
 12 910adbe0-428d-0ef5-b8e9-831f317533b7
 13 ade89167-6f8e-6be7-8df9-087617f9506d
 14 3621a052-72dd-42ef-a72d-b546064a4aef
 15 8a9c60de-e40e-33d9-b08e-a02fb9cf5280
 16 89fb8643-3f60-67bd-ad3d-59b0aaa05b85
 17 b41b64a9-176d-687b-a8f3-66fc76e1060f
 18 615ebb3c-6059-263e-812c-d63c4aed4548
 19 48723a80-a08d-3d69-b9ed-08ba02cd3262
 20 b612d284-31aa-7c96-96a9-a48a20e66c0b
 21 ab742272-7614-39ff-b76c-16ab4d558c9e
 22 37848f9f-62bc-7725-9f98-9b8214ff7152

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0602265557306436623737. Exactly this sequence comes out of new Random(102).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 507 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related