201209232330 10cboy

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 376

Metadata

Post ID: 10cboy
Title: 201209232330 → 2012-09-23 23:30 on A858's clock
Posted (UTC): 2012-09-23 14:30:14
Timezone: UTC+9 · title 23:30 against posted 14:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209232330) = 8de3ea000c98748ebe8b77068cf3012e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(376).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 15 · predicted N = 14 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B7D6762106C70683 731B497A461A7A33 49924A43D683A3E1 7059199B86F6FDB4 F0550923CE40A5A4 5FA4F7ADCD4CEFD9 7DB8235F6B7FC458 DB585B8DFB29C96F 656C9284180D84A4 FEAB51C9A1FD3524 0940F5725869776A 2325F37F9CE49F42 ABA426991E1DC1F4 960C56C45E4E037F 0B7728649678B2F1 7615056E6E6D4383 FAB5A6E95947A43D 358CAA01A076DD36 E6FA4F34D1E0836A 071FA3890B916E88 D02B1BBEFA6AC893 0F32709C63C6044F 1A836683F7F973E3 EF26E986DC59725B 306A30EDA6B8BA9A 351D65BE075556D5 079D586BE295A1D1 2D5C9862F0717FF1 68546328C8392F89 25694B4ECED47D7E AF2BDC9E06BFBEC2 4A34A481F663B3D8 04F446B561AB3F8A 94BF1A7CC6958870 3BB9D85006738466 6ACE2D9BE5149729 7BAD4121B348CDD2 01058659297A0799 E27FCFC30DFCDB24 300D7C9437828C16 718A2B01E5EF3127 9675EF2584A03970 5DC2DB2841B4BE76 325B86EF8ED27360 891C87463CAE5812 3E8CF2865053F244 85E75D3BBEF713EC 7E961F3D6859D4F8 984CD611582E13BF 3AC5C725BB8988FF E3C9CDCF2ADCE503 14ECB00D2EDD9190 DB4C063C7B4D6C8B F0C93C9B87BAC4CC 5AD25C4A5E0DB3B7 2E46246B4AF4B646 157FA9A7991A6D66

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209232330 (name+title). Key = MD5(password) = 8de3ea000c98748ebe8b77068cf3012e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 99974ae5-e084-1840-b846-84114c1f5f6d
  2 dfd9aa5e-8f77-1e31-901d-6a05291f7db7
  3 d7dff5d5-9e9d-580e-8528-16095f6a17f7
  4 39dc88df-5aaa-78ca-9499-c204e9a88567
  5 aa0b6a6d-afe8-8bfe-9643-ad844b376100
  6 416fe104-4c2e-1c13-a5e8-219c3366d689
  7 efd46626-1068-38e1-8d93-f06ce1ff5780
  8 e0977c22-e667-0f57-93f7-fd985bb86d3d
  9 1972b389-f663-4970-9048-c94ce60644d3
 10 9aeb7f07-6531-8e80-bfa6-ad026d519b39
 11 a310c28a-6eba-239a-8d9a-7059145b5223
 12 98053d3f-d429-0ff3-8d87-66843182a192
 13 9e8f0472-739a-1008-b5f4-2beab4377604
 14 2f2512b5-da44-0921-bcaa-1087d8d97ba6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 11578130482010. Exactly this sequence comes out of new Random(376).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 15 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related