201209231409 10cm5o

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 670

Metadata

Post ID: 10cm5o
Title: 201209231409 → 2012-09-23 14:09 on A858's clock
Posted (UTC): 2012-09-23 18:09:54
Timezone: UTC−4 · title 14:09 against posted 18:09 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231409) = 09575cb714636144e88af63d53d3180f (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(670).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 87 · predicted N = 8 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

0BDFFD82DE87D2D5 33886000FB4B7161 8633AE46A436A4FC 0C4EE492C965CF7B 45AF6A8FF65A82DB 19780E955711AAC9 F33A70A9DF568B80 025A14BE1B2087C4 4EB464F0A72098C4 40DE55C331A6EB16 5BADC6D5FFA12C0B 5EC0F3791882A9B6 D6EBA2E03B682C0F 6137ADC1A717C663 5862F30C90409B6E 850FBDAC8F68A423 C691BD43C9716F28 8C170105371D7F14 43C8A83D77AA4A35 E784EDBD61D0DA2E A973DDAC69DF637A 3E91B2C521895AE3 A9FEA46BD2D2C681 DC4B3FE3100E00CC C3A5C73A270DD551 E7A743007466115F 64D6D6148BA26723 F47373468B49CF29 0819A087AF3F9F3D CF46687CDE8398C8 BFC28CA04109F616 C8506BE367EE641E FA01953915AA2A3D

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231409 (name+title). Key = MD5(password) = 09575cb714636144e88af63d53d3180f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cae5232c-51ac-6409-a896-6efa25c5acdc
  2 2c17b69d-bce2-3279-aec0-75a93b7c7443
  3 d6ba8b95-5aea-0d39-a82a-f0d78594fd81
  4 73b6ad49-37e8-5e9d-a43f-1c0d303e838b
  5 40f73dac-7a10-6085-88e0-8742291748c4
  6 2cf20136-9409-0e01-a706-c27570d5123c
  7 3c661baa-c51c-09a8-8cf7-dc13c1f83476
  8 1640aa87-4442-530b-ada9-ea957d110a05

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 63056005. Exactly this sequence comes out of new Random(670).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 87 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related