201209231322 10cjl2

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 983

Metadata

Post ID: 10cjl2
Title: 201209231322 → 2012-09-23 13:22 on A858's clock
Posted (UTC): 2012-09-23 17:22:22
Timezone: UTC−4 · title 13:22 against posted 17:22 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231322) = e9a8f78ecb3fa904ba79cb7bce81542b (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(983).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 40 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

223F6716E2DC0CE5 D94F2B243FE2871C 02E42F1AEC8FF0DE BFDB0BEC533829FE 30ACDD0AC7DD4C87 C59B33EC6BF87034 DA8D8F9411B6C200 B5620417AEC7371B 1215EFCADBF5DA81 03479482B17EB916 47C937418B184040 5CC0DA9E6976B751 1EA500FFD31E012E 61CC0EF8819C59F7 8B9F60637AF4E140 D3533CBE50E27E68 546B7C69F40469BE 5A895E7191E3C5EC 6B8F2DD1293825A0 D73F7F6BCCF8FB83 8A9A98A3E739342D 56297D56C1411256 2F047EE6315405E9 1D61037B9C985AEF 5F4E8548F8BFDDF9 4E33DE20DC42F011 7068CCE10663B599 3658161EBB163361 D7B819A6C7E88819 D354631BDB9E2144 F64DECF4B3FBF92F 42D81B7436FE321F 72B07D6B1C0F6F15 D673E239071B42D5 5FAB532B6EF3A0EE 4471DDA5A15B6251 B6D9CD4D2AB9B77A DF68B3032DEEC31C 1EC2751DD14352F7 2CFDF9760D83BC5B 2080BB753C8AB94F 8AA2B49BA9440548 CC74D9636E98D901 03B8650DEF47D66B B319F5926B7BA14F

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231322 (name+title). Key = MD5(password) = e9a8f78ecb3fa904ba79cb7bce81542b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 749a1053-d432-22fa-9972-855186a16e3b
  2 e0d36945-86e8-2da0-a1e5-eee40f461bc3
  3 e6dffa4c-757a-7738-bf24-8d76cccb1cf4
  4 a9596b23-c1bf-364b-a007-124f2b997cfc
  5 b267e28c-13c8-0e74-8727-b7d963307a05
  6 40e44ebc-3641-57eb-9663-1c5f6f7e8cf0
  7 c404a300-ab6a-34b5-a8e2-a72afc572306
  8 ca3e4b31-0fb9-592a-a6f1-35c2b0d9fed2
  9 f4d8a959-680c-58d3-bfee-74e084a6cee7
 10 1fdb483b-009a-6841-a87a-e58af24cfc3b
 11 4de40ca4-a534-4f56-a3c0-f6b1f0ee9648

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 22730535564. Exactly this sequence comes out of new Random(983).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 40 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related