201209231334 10ck8x

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 539

Metadata

Post ID: 10ck8x
Title: 201209231334 → 2012-09-23 13:34 on A858's clock
Posted (UTC): 2012-09-23 17:34:30
Timezone: UTC−4 · title 13:34 against posted 17:34 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231334) = 3e6c635a9f884a1ebc626ca884ae532e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(539).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 52 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

931181572EF0F309 1538E4F462829F45 251D77D33C5129DF 9C3F11CF5459C002 45DFF007B1F793DA 0A27915AB1F53981 22C836A78B3CB3A9 4FF787D25C5C13E3 ED2D39EC61866F91 DE38F1A7A59387D7 A549F1B8716A3025 40F6617C112A4B5C 1D916968D05F3A79 B2CFFC72314185B3 BBF3C47FEC0E238F 14A3C7FABC83255A 45FEF2019E6F3388 CDCDE66C3313B494 4E4E8EF7C7749112 666BA05129B76CE8 C6A5267550BB331E E16C08EDBAB96EC5 96B43EBA9BE926CF 012A91E6DBE026F3 6F4F156800311695 105563521F710827 EAD1ADB6B282C9C1 65EDFD25C6A68797 69EEF0200C34A5F1 C7BBEDA98D23FE26 09F0ECA2A209138D CA22C903BA3EA06B 9E8458D777C26FE8 0DB878E88D8DF27E 7E4E08225D335500 0419688CE56153DF C77956F183F43789

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231334 (name+title). Key = MD5(password) = 3e6c635a9f884a1ebc626ca884ae532e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a0a43670-abb1-2a0e-bb52-a4b8694eb422
  2 226d8fe0-117d-842d-be64-46cc22b6dc75
  3 c8047bda-7cc8-4da3-a558-8c1e6366d47a
  4 02bc33e2-2fcb-5abe-a694-cab477b9ad02
  5 b3c34179-3abf-56b4-a8ca-91df1a281075
  6 8b0770ae-2a03-559d-a8e8-6550aa9b0949
  7 68bee832-c06b-3c1c-a230-06621118289c
  8 f2935f11-535a-78df-b0b2-ae6d1cdd757f
  9 67da0abb-8f65-5d27-a929-9f7a5b79db5c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 284555375. Exactly this sequence comes out of new Random(539).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 52 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related