201210260021 123wmd

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 698

Metadata

Post ID: 123wmd
Title: 201210260021 → 2012-10-26 00:21 on A858's clock
Posted (UTC): 2012-10-26 04:21:15
Timezone: UTC−4 · title 00:21 against posted 04:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260021) = c4889a554c14068a3f97e443d222582f (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(698).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 24 · predicted N = 17 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

54C8BE46926BA381 7D2FBE39478A8157 E823BE526A4567CB 589DC3A28600C403 B190A26D870BBD0E E19CE657AC80C80C CCF044E012C381C1 EF8C5A095DE0F2E9 92CEC83D2FD88FEC 75C86DE7534AC570 7B336F08306A18FF 2EEAD19907D398A3 24DE07EEEB9A130F AE9B74F40F5F0024 C7DF7134B4F1373E D077A42DE66767C4 7A8CEEDBAFB98766 F29A515523751562 554CB5A0A06FA023 6B34CF4988999F53 E565C78348432B7E 4E28BA654010D11D 44458D58E15DD3FA 579259B2B2E4CF09 3DDE13BC4748E073 D53CAAF268114CB5 247996D4186CE588 903E34A394B76B8F 673DD83214C77742 511CA32F1AFFA933 82D47CD6512E406A 03898730D033525B 84A60D56EFA37326 DBD08F030A2FD300 DD1E0D4D7EE3C885 95906F036FEB33EA 39EEF407BDEB7544 C99DAB50B2673663 798CA2E2304E33B9 9B6660D54F914F12 E5E1208E0F6C083A 8F9AAA57430F19D1 B10AA0505FB9221B B7E77880064E9DA3 FA443C6276911080 ACB3C8C5D2D14E43 2A0E4C222634623D 75D0A34AB402B96D 262792AB9CAAACDC 5EB3DE8EB988660E DC65D84AC6B26C7F E98FCF5F7912E0E8 3919A7D6D5E526C9 E19D81FCA8C4FBA6 1DA7C8BB2DA0341F 4B0BF8BC0DCA0DC8 B2E0D7035D2DF83D 6F7657AD02610B50 4E087D81CE2C52CF 95FC0C5F732BB2C7 270987DFC9471283 CC1ADEEC22148853 C582B27D49A18D44 F5C5AD053B8D9AB6 389764B80D5FBF01 D68D054629050E4E 3D431A6C4AEE7038 AC1104BEFB9796CA 22DF9F0E7EE41E2A

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260021 (name+title). Key = MD5(password) = c4889a554c14068a3f97e443d222582f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1366c188-eedc-33a2-8fa6-9619b208026c
  2 5a32c2af-1cf2-539f-ae36-20a6a424c649
  3 203425ad-0103-59a2-a437-73d6144bc6ff
  4 cf93d322-c8e0-4707-b34e-01810ddea2cc
  5 a7d5b07b-7b4e-3840-b02a-eca408ef88cc
  6 3b6c0062-5667-4b0d-ad4c-1e4d4ed45b57
  7 6f6b8444-6df4-513a-8c15-4262b5b0e8c0
  8 97b9a62e-641f-540e-88d8-3ccbbd9afab9
  9 aae2791f-5c9b-2231-aacd-8b855211044d
 10 b9bb914b-6fe0-557c-8879-8397712890a6
 11 e343255a-058b-4e14-b8e6-a1e7ae8c07ce
 12 47ff68a1-1144-3d25-93b2-68132803712d
 13 1a178b97-1953-4db7-81ca-c0f181fa1284
 14 eb99fc44-3680-52ce-93f3-ee6a234b72a5
 15 ebf721c8-e50b-53c3-bde6-c37aeba4cf67
 16 f319076a-22b7-8507-b404-c124f4061b4e
 17 a3f3ba7c-8b86-2f13-bc68-4943fd90b89f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 35543455254345582. Exactly this sequence comes out of new Random(698).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 24 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related