201210260135 124064

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 977

Metadata

Post ID: 124064
Title: 201210260135 → 2012-10-26 01:35 on A858's clock
Posted (UTC): 2012-10-26 05:35:46
Timezone: UTC−4 · title 01:35 against posted 05:35 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260135) = b130d15887abd1010dae64ad11006523 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(977).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 61 · predicted N = 22 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CD4C82B574BF2E16 4FBEB7D8322DBFAE 595C8F5AFE98D859 DD79BF9F25FEF8B4 8F1E9B8FB0E0F3AD 4260B02E589D42A2 3E0226A3B1CB25D5 9D1A2E29CC1ABFB1 18C98F659727674B 764BC3A886727E7D 347D59053C7BEDC4 2F14CA94C536269D 4FBFA6E981FB2FF0 65BED9F1BCEB8E06 0B0A4AE34D90E5FB FF17EF99F8B53A5F C5008C0958C34E83 8987C99674B3074D E18568BDBE37C7A7 4282CCC9E49E557F 7FF2FA5952F321C5 DED3AFF329E7905E 865845F07B2F71F6 352564DA65B100D3 FDA05C1CAC12C4C0 3D89D43154501115 6D33D4C7A5220FA5 9BD43804F2BCD910 5F39CEE694E378BA 738203E08079934D 51115DA77BAB625E E4FC8BC8A6062A91 238F08CA3D8F0105 3F0470FA82DC5A0D F8EF97F2809391C1 C2746EB6FEE7DAA8 6B67465D8C871987 9AD600387CD13BFF 5E3BF6916FBE618F DEF2B0143852C878 C5375A0FF3557920 80F23266406CB39A 6B3CD3DC0CC7CD34 63A84566EF90E8DD 3DD08AA257A6B653 3344190DF69FED1E 2B4CC7430F23E872 632A23AB02E66CD6 3CD3CB18671CC196 7BE32D0CD2A2B9FF EA45F569D0338FFD E8A52495B352D985 149575D1C6357CB7 022D525DF2EA468A 317C551304CB2D66 E6863B6EBEB48866 00DF6701D5B096A8 70522AFE46839BDA 13C98ECC1F505A54 49560782546E732D 9F88E7E5F0BC581F 6A4B1124C17535B7 C8B73AD257BA0B0A 1B5E26D2B62C5CCB 2C1500C0AC2B8012 179CBDCE5BB0FC8E 649EF480850EEA65 A87F04F1BEB32CD2 631CB20AFCE87987 168DCF0B34F516E5 B1E023E8E4F23956 3FFE8109E183DB04 8B2439D099DB5769 4BAF76DB13112524 73FF2107E224C518 FC83D937CAFF32FF 45E2D3C7685119AB E085F51EA715E075 62209F481F3E8F49 94B0766599291629 4F5D7DBB6E6756BF FBC2230399F41A68 D0E81C69FD0E91FA 7AFE2FBB6E5F84D0 642F4CC1E91F1443 255DC1109D6EF641 4FE69AAD22226747 CD40F647EA396C2B DC856C36E8C9B69F

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260135 (name+title). Key = MD5(password) = b130d15887abd1010dae64ad11006523, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6a9235f1-d38c-1f79-8ba7-b9ba8be6c606
  2 25d14886-fc06-4a8e-8b08-93f97ed90d1d
  3 37359161-db9c-6e0c-95b4-d09ec2988792
  4 ba670f71-b81c-0562-bb73-fb7bdfd5f312
  5 3d92ac8a-996c-2600-93b9-02f771f6f4ca
  6 854fc865-0ac4-3b16-917f-8d4d6092989c
  7 641b5592-41ff-5cbf-88f2-c20ed5d742c7
  8 599aba50-23f6-5873-898f-8410c4ca8226
  9 403e9520-f3be-711e-bc7c-eb3bdf715622
 10 31eddc1f-6b8f-47bc-b1b2-d619c0aaf130
 11 8a2c626b-783f-0dc6-8032-4f2442fc4a45
 12 0a2c4b35-4b41-276d-b0cb-0bc729cd4d41
 13 f3f72015-db9e-223c-93be-95058384c525
 14 757b4b96-b4c6-6afb-b988-09b6db4a96cf
 15 9f35f80a-3b27-7fe1-989e-da7046c1c978
 16 b4afe967-ab09-1fe0-92d6-7842ab47d042
 17 e56af2c6-74c0-45df-acb9-83f92c7e26f1
 18 80352020-9e5a-6f18-919a-5fa6398b2629
 19 1ba02000-a1e4-1780-8410-c01888506f48
 20 02314b0c-766d-533f-af02-54dc91b16992
 21 8f2eb5d1-ff44-5b29-b441-f0190d12cefb
 22 47481be5-631e-42ed-a72d-e15b3a029277

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1460235574022671461554. Exactly this sequence comes out of new Random(977).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 61 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related