201209212240 10a5at

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 469

Metadata

Post ID: 10a5at
Title: 201209212240 → 2012-09-21 22:40 on A858's clock
Posted (UTC): 2012-09-22 02:40:09
Timezone: UTC−4 · title 22:40 against posted 02:40 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209212240) = 051279db1d9deda631edfa9ba05e9d7e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(469).Next(9) ✓ verified
Run: Run 33 (seed 1,220,410,968) (seed)
Draw: 10 · predicted N = 10 ✓
Machine boot: 2012-09-07 21:49–21:59 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 2
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2803A00A6D5A097F DC7F0EFD997B7DE1 A285E55E28F60751 10549BADD1DB22BF C5E66A1E3B174AED 738BD7E17E284DEF F8DC6631FCC297B1 8A82A62939027A76 45A2B4340862E679 FAF979A60615E7C3 EBD7572CCA2826ED 17D6147312E597C0 1EA2320F2DBDB76F CC79CA7745FA5D29 B4114F887FC340A8 BF48910F7031117B 79C6DBE28152D766 EFB3B4C6576683ED 51AA0186E4547A45 065C1B3D450AEC01 5181CD879930427F 2EA661A66E12DF78 FB5266087664CA7A AA47C57799FF0A13 5DA81C1A92B48EA9 0EA63F694142BB12 BC2C77DDE3015223 FF92848ECC62A0E4 25CDD2C5BCA5ADAA 4C79B9D4F215D17A 237765539C7E567D 27FE0D712C0A6380 C836C680739D1A1A AEC37AACA0E6A873 6FF43A637637CAD2 6C3514BCE3B50EA1 1F02A1B6805FFB6F D4271325EBD69FBA AB8428597305C456 0344EF0E1622BE99 B5E5DEC43EC0676D

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209212240 (name+title). Key = MD5(password) = 051279db1d9deda631edfa9ba05e9d7e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0d7bf693-6fd6-6aad-ae47-b1928b6f9be6
  2 8fe50ecf-2dc5-3e79-8748-f15a55fd9746
  3 e2b2f689-50ba-5fa8-84a8-4503ecb79671
  4 9c54a315-65a8-5170-a4a6-22dab36e8523
  5 0aebc9af-eb02-82ed-84f5-da65af833b71
  6 68a0eb8a-a747-3597-82ef-ff3e7ab9ac78
  7 a45ce1d6-1f9d-0be2-a425-ab10d60c6e5c
  8 ef54b6f6-7210-67fe-b9e3-040ebfd34123
  9 b4800e8e-f066-0ead-bb2c-023a0071e3fc
 10 c61bedc3-2a36-137d-854f-782cd2ea6b24

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6355830601. Exactly this sequence comes out of new Random(469).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 33 (seed 1,220,410,968): new Random(1220410968), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 21:49–21:59).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related