201211082155 12utwc

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 797

Metadata

Post ID: 12utwc
Title: 201211082155 → 2012-11-08 21:55 on A858's clock
Posted (UTC): 2012-11-08 13:55:37
Timezone: UTC+8 · title 21:55 against posted 13:55 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201211082155) = 880fc6f8d408393d23dea82c805d5934 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(797).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 129 · predicted N = 21 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1AFB0FF892D64B89 22DE8DED6AFF8AED A9EB46192C2AF565 F9E875D937C416FE 7A619F65143E1AFF 35727E9B383CFAC9 35CB3AF6D5C94B6C CA88788D7878CF2F AEC6D8D7171E6945 2E5C5DAB7B6AB3D4 6BA4120753978456 E0CC901A80BE7E1C BD260FE087722C9F BB629BF14BB1FE20 7CABB4FBB1D3085E D8B0696C323F6B6C 8FE43EBC4623422B C6818005F4CA2460 5F36C0B1B430E109 B6812633FFFF799F D0F5285FA925513A D79721C027ED63AE 43019F95737C7564 04BAA6DBECCC671C 1B4F084D9FEEC2A9 4A41E2A419C817D0 13024DF32146DAD7 C3FCB390F3ED5BD0 E89961BF7A6EE440 F9740ECC9D33F675 46C6AC43164565A4 49EC803520B0D09C 24A344CFABC4B104 8AD5E39D3180BA0A A7C9B0018B9DE784 E4BCBBFECE07AC64 C79916B387599200 4AF373834CF4BD5E 866F65E5EEA14A77 6B88EA18DED04D2F 85B621FE4BB3D9EE 228D3DEF5DEAA6D5 E3272E73A74C8654 0C6A18784DDE60BD 43B6004FD5050FC1 FAB3052EAFC4B9A2 CEAD7A758CBFC179 C94D39EF37CFEA31 4C29B7650E57E778 0BCDDA68083869A0 D7B696DAF8FC3369 8E6CC869DCB6BE90 C037CB1F93D1772B A5136A5345B42BFF E7BC40152CCEA48F 9771BDBD06EC575F 91F555E71E9B61EE D33DE7111DAB571E F162DA8FF2A73940 3A1392C098D59165 D2B5783B6743C29C 3BEA08E34037826E 39C1D7599E5F9CA1 45F5DA70A66FF13C 2CD5E68CD6F5F354 DDB9666E23700DD4 E8DA480E360E8243 BEE640660417818D 0B0DDAF96E938C5E D1742569FC1631DC 461D7693CF0FD025 6D575AFE067CF708 3A3B8475499AF525 36EC6E20C3B1FB6A BD91E3AF3DC85DA1 E1E86E3A301475D3 1F41C49083E42617 3BEE26DB45ADF8AB 29FC744137FF700D 56841AB917442F8F 298228345EC4070D E77867557AF0A20C 2C9378646EE39075 3817488E93F48238 0BCBA4142001F2E3

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201211082155 (name+title). Key = MD5(password) = 880fc6f8d408393d23dea82c805d5934, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6745684e-55a6-02b2-a4cd-2f843dbac576
  2 1f9dd03c-3506-65d7-9747-32f4e9528c60
  3 452271d6-d390-7351-9fb9-a818c02066d0
  4 43a90c19-7f34-6e5a-8c7e-0372769513c3
  5 94114ef4-913d-09b7-b0a3-31c87923440c
  6 66f1240c-be47-00c0-af0e-f00c8908c930
  7 18c541d0-e821-0f2b-97e0-ac076aad22f6
  8 e4c7e5dc-d250-2cd6-9749-941f5a6608d3
  9 dc3f7c26-cf7b-5fb9-9d68-fcd4d6ad5363
 10 0668bf89-ce9f-1e94-96b8-b5ff0b5c3eec
 11 8fb3caf7-53c0-4e51-988c-f1caaf8b859a
 12 f60ce71b-a775-6a98-aadf-b4d68618d81e
 13 2208db5d-ef1a-4beb-af5b-fa825545717c
 14 4ec55beb-16fe-13e9-878c-7d4acd394459
 15 fcbd76fe-cb87-7fdb-8013-681478ccc89b
 16 d7ef57a8-f779-67bc-9ec6-b91b6735d8ad
 17 33055b87-96cf-7416-8b40-4c79e3ce256a
 18 c4f84dd8-f77f-1261-a6f2-137e69a3c024
 19 ee031d7b-7e1c-212c-b04e-e3d2661b2062
 20 f01b9acf-87a6-88e9-8108-551917387bdf
 21 1f983523-1d70-6d29-9059-152cd5a27657

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 067600025146417671286. Exactly this sequence comes out of new Random(797).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 129 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related