201209231356 10clg2

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 123

Metadata

Post ID: 10clg2
Title: 201209231356 → 2012-09-23 13:56 on A858's clock
Posted (UTC): 2012-09-23 17:56:46
Timezone: UTC−4 · title 13:56 against posted 17:56 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231356) = e655c85f89e9ce9f35c00a1cc1c2adf8 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(123).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 74 · predicted N = 8 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B118CEAFE03A0A94 2AC4B3EF6D41FE20 EDD56565C754E29E 37CBB04A32C2EF49 D81AEB7A468F3BB7 75A6F239FC611B6F 7B3EDAB7E8E64C7D F3BFD9F59761C59F 6AF85E4FAEE9BFE4 5613B49CA5FC3974 0B947FA0F90C8D24 2AF99B531822244F 95AFC78BD5C214E2 BC70F79184660799 CDF853FC381C6EAF DE2F78189829E537 F63E2DA6B490A805 910B3049AA804906 44C67A9C700ECE2C ED91252A2771DE9D FC240FECE0EE6F96 F581D91E5D034E56 F1118264F4DB92BA A2450F2B09B2F7DC 7862DA55ECD5C3D7 963E0662694DB09D 7EF668772299FCFC DB50C57C356386BE C0C5B03ACFF7E1B8 2DFFA25807EC29E7 6F6964D15138D97E 3208C8DF2C9BA03B D63E995ACBE10E83

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231356 (name+title). Key = MD5(password) = e655c85f89e9ce9f35c00a1cc1c2adf8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2475618d-1fcf-824e-8b8a-a71a857125e9
  2 d0076c4e-2f4e-86ab-9e0f-7bf863192f87
  3 41cb36cb-6826-62c4-b007-2a68fee645ee
  4 b29b5117-4969-77e4-87a4-5327647de1fc
  5 dd66a6d7-dfbf-6620-bcf9-7c9497197c86
  6 f35f17cf-2a3b-0334-b0e5-e486ebf1b504
  7 e1443aac-ecc5-0aa1-8635-57e84db00268
  8 e3e56a94-9f0b-1ad0-a92e-a16c701f7de9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 88676001. Exactly this sequence comes out of new Random(123).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 74 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related