201210260105 123yur

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 508

Metadata

Post ID: 123yur
Title: 201210260105 → 2012-10-26 01:05 on A858's clock
Posted (UTC): 2012-10-26 05:05:31
Timezone: UTC−4 · title 01:05 against posted 05:05 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260105) = c7d68e707948662c5a438b439c533a08 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(508).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 46 · predicted N = 21 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

38D116D440EBB417 A1D1009A1E1A29C2 33FB5CE3CCA50893 7CC6FF385F4F9220 D44FC73C1CB227F8 F994FBA32171DD38 40AD1D58564F0A01 2029DA24ED8E1087 9370A2DC9620092E 5A36AB5ACC5DF544 628A99926BAEC995 B09827F6E72D225F 47ABEBF463B9BDDC F6FBC54EC6E4706A 673FBAB6C9AC80D8 049ADD6C6FC125FB 39A16669AAEBDAA5 9645DD4BE4BF4ABB 2E1A38F20C6576B8 369B2C4BAE99B7A8 5C4FBD97A9174084 3C7029493D862A5E 95E4B401C6E78657 A4E4A981E0C289E2 CE00FF838E7C7C05 540B6DD4D2B5E614 7BD628DBE3B94D86 CEE17E1B41F186D1 E282AEADB1A08272 0CFCD1060C42A762 8BE6DA8066C0FFB4 0030CA4D406F35FB 29E65AA96E2FC10F 38A58616CF1AE9CE F0215447CD3D2B6C 9CDE2793E1ED1275 8CCC64C80380BB58 F48FAF3DF167FCC8 8DE5467A4B600255 381CBE115F80F907 C1D6282FD6386089 A51ACF3785F0B8D0 ADF521A1D13A7EB8 1F5A58C09B07507F 6DF26A3BE633C43D 26F5EB3E3F3A2F66 AF21DE90D28A786E 78EEA601D865D5FB 3D72D51A9A67E96A BE018AA72AB4DEA5 EB8FD99EE311B3E3 09EBC753263884DB FEFBD9AA97B428EB 51FFE3E513990087 F27D288DC1DABC47 793F995FAAAE0815 D877EB1423A57596 23A5AE57EA6C8CB9 6584F56F204CCE01 49A7D474E66A8C1A 7C4AF5AAC23CEAC7 C663CC89AFFD8C1F BC47F770A1DF1F28 9554B29FBB65A6BF D9E52439A75F2AA4 DDB64C9A61B59729 76F8289A840F87B3 93D624D295AFA041 53CF1E38C129A4A4 04EB1175D0C2829B 89078B2DCDA081A0 51D0ABE9EC262B5B 55410A7886202EC3 3A696F0AFF24DD5F 312BFD669810181E 80746FC154393503 111FEEBF4BCCDADD 3E0ADEA83973B060 55A3A5118B0F0850 2B56D218BC9EFCE3 603C56BF9F853638 5D01BD085A1A50EE 04AFDF784B1DC416 E06783A707A8D401 A06DE248654B20A0

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260105 (name+title). Key = MD5(password) = c7d68e707948662c5a438b439c533a08, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bd5dc7b9-5cfe-1c25-9096-8170de491442
  2 bea06534-b130-78b9-bc57-54471108c407
  3 fc1ba04a-0fe1-7e30-a747-3af303438dab
  4 25cce6e8-5af1-8813-a737-8dc816c979e9
  5 b84b0529-a27b-503f-a45c-9b10d26f38cd
  6 277a45e9-5fb4-4e51-8f33-53e16bc616dd
  7 c04e4f00-2573-4706-b774-c6896f0e084c
  8 d10a040f-3ab1-26ce-9d6d-c072c4553ea8
  9 5af5d443-6607-7bce-92fe-090c3a128eda
 10 a3565742-a40c-5925-8283-85b337f095db
 11 e3576d5e-7e8d-4302-bdc1-8111b6fa17d7
 12 543a44ad-fee0-081f-a53f-0aaf64afeacc
 13 1a944bf9-c9cf-73ee-b126-11ce5cd4a4d0
 14 8112d700-b1ec-6d73-af76-3ddf268db4a1
 15 e8448d1e-0dcc-519f-801c-bc94d45a5369
 16 2d4573be-76d1-29f1-a7d9-03728b54e213
 17 17f79656-8590-3709-b54b-4398b4c40cce
 18 4b26cb14-06e1-88e4-bf3d-b0f6e8435f70
 19 47ec55a6-f9cd-301d-a07e-2fc9053598a6
 20 f2927357-d814-079c-a30a-7f15d897ba3e
 21 0aac2d3a-8938-2e5a-83d1-6d9458b4c92d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 177854427540765238302. Exactly this sequence comes out of new Random(508).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 46 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related