201209201045 1064il

explained decrypted filler

seed 885

Metadata

Post ID: 1064il
Title: 201209201045 → 2012-09-20 10:45 on A858's clock
Posted (UTC): 2012-09-20 01:45:19
Timezone: UTC+9 · title 10:45 against posted 01:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209201045) = 017c1bd4f038bb90f602621187d96a69 (name+title)
GUIDs: 10
Filler GUID seed: new Random(885).Next(9) ✓ verified
Run: Run 32 (seed 945,377,703) (seed)
Draw: 20 · predicted N = 10 ✓
Machine boot: 2012-09-08 22:08–22:23 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 12 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7E8D83CB235416F3 572928BDC644957E DD5A437D723E59A4 36FA60EE8FB7BC9D 2BF62B14F5D62264 64CDD65E2B221382 64523A0C78330F5E F27512361B865E53 F892E0FE1EE12D36 7B9ADDDFD287F1D2 B3E9BEB430D33CF1 7BCFB3711EA30F26 2C2BC3DF01343FDB 01531F6A1A0B80D1 754D2E31CC56063A 7474D43C3356D569 2371EE2385C883C2 DDF1F9F57A4FF343 D8FE22A05F840769 B58DA4B5F728BF93 A60C3968F63CB93C 5FAC8A712773B7B3 D92AA24E99E07451 A2D75CF57DCCBD82 F7F99C448CBD54B2 2CEB95EAC3680943 54B9372E1FBE94C7 0C12FFD1B5069C1A F748C1228BF5930D 7BB6426E986D6537 19AF13BBF39A946D 1CDD50E00291B6A9 1004647727E420C6 F31A27BD35E9CFD9 E17A3ED59587AAD1 AE08085F0C0A9774 10736FB66BF1D86C F0DB299C45531BC3 AE97ECE6DBAA3490 1F39BED6D68A93F9 6DFED5FAF08500DC

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209201045 (name+title). Key = MD5(password) = 017c1bd4f038bb90f602621187d96a69, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 27314ce7-fb20-0c32-bdfc-2df557990917
  2 c71e86de-cbe8-43c6-9bef-4535eeace2f2
  3 a843beba-1d10-3021-a598-d7c876b28f8c
  4 c00768cd-d9df-4f78-9db8-a49fa67c66c4
  5 007b36d6-f782-6cf5-aab7-7fbb29d4ac91
  6 cbe62055-6494-88a8-b21e-4a97f0d420cc
  7 9fd8b42c-5412-3350-a8a8-49f7f5294159
  8 ace8c8c6-4b69-39ed-b7fc-ef79f0a5c528
  9 76cb5e0e-ce20-45c1-95a8-0c3eb5de0b41
 10 8eaa3f65-7ce4-557a-91f0-ae57adfefa8f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0434683345. Exactly this sequence comes out of new Random(885).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 20 of Run 32 (seed 945,377,703): new Random(945377703), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-08 22:08–22:23).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related