201209212220 10a4c8

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 827

Metadata

Post ID: 10a4c8
Title: 201209212220 → 2012-09-21 22:20 on A858's clock
Posted (UTC): 2012-09-22 02:20:07
Timezone: UTC−4 · title 22:20 against posted 02:20 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209212220) = 13ab00914eab805c7bab9ff3847fa314 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(827).Next(9) ✓ verified
Run: Run 33 (seed 1,220,410,968) (seed)
Draw: 8 · predicted N = 12 ✓
Machine boot: 2012-09-07 21:49–21:59 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

068FB48481FAEDB5 3339128817FAAA07 296B33919343D5D6 3207D4F628060479 41693CCF9EC82E3A 566BEDC69B8329EF 397B0C7781D1C610 E0021703A7C79EEB 9D3F08330300F601 8DE47801048AE556 540063513EDC7A65 333541D7333C8E16 5F20AF58866A1B7E B05AA388C6628FE6 A886F0CF62190218 6A4DA480F96428ED 45D8300E0FE58FC7 F9F092F16369F834 24C9B6BF1210C351 5E535C5BAAF327E1 D73D4418AB09E874 7FE9C8948CCED3C1 B7C5192CDE65C074 8ADDA7CC39B8AF27 0666B78384589A93 4BEB50A0D1E508D5 8E9C208FA5195341 90065C773001069E 682E17B273EAAA9F 1BE2153258F6A0C4 6367C6FE314C01FC 6FE9CA752A1B1F20 168A4DD2594A9479 15F7A40917A77194 BFBE5A0243D0E48C 1337781C1EAC0618 16445F754BE0D2CF E8710EA518524EE4 1208DFFCB50B9A79 7C9F5A658E0C667F CC7B7D743AB4001B EB53FF6A4902D505 D1EAD74C77AF13A7 616F55B58712A852 6AA5C7A17DEB092D 9F1E75E3E9EA3810 766AAC2067E2FED5 C0A705CB2D08FC6D F3A6830332AC0039

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209212220 (name+title). Key = MD5(password) = 13ab00914eab805c7bab9ff3847fa314, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 08ddb29b-d4f5-60c0-a6d0-e510809ed838
  2 b485aa6a-3d58-4a0a-8f2a-f16113707438
  3 8410327f-216d-78f2-bb5a-7dd3b2225084
  4 a1c9957f-c901-0880-a40b-61f514c9da7d
  5 55a140f5-572d-5313-acab-53b24dc062da
  6 616684de-c8fa-235c-a267-76fe2cdf735f
  7 c4e56c64-953b-46f4-8aaa-ecd8c17e36fe
  8 7a907723-9fa6-3a82-bb08-02c27b89e8e3
  9 1edadc8a-5b89-240c-a50a-e19cf805f25f
 10 868d78fd-9226-296c-838a-2546289f007d
 11 6db44a75-84c9-54c7-a0b6-12655007ea4e
 12 24707204-ba5e-1017-aff4-6a395ff5f543

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 647052432251. Exactly this sequence comes out of new Random(827).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 33 (seed 1,220,410,968): new Random(1220410968), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 21:49–21:59).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related