201209231420 10cmp6

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 226

Metadata

Post ID: 10cmp6
Title: 201209231420 → 2012-09-23 14:20 on A858's clock
Posted (UTC): 2012-09-23 18:20:01
Timezone: UTC−4 · title 14:20 against posted 18:20 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231420) = 706a194be837dfde9064baab1d265dbf (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(226).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 97 · predicted N = 8 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8190D465FAE35B0D BB6ED18628864EDE A7DCA1C259A32BC0 005D42A79EC84631 53D078BC44856D14 5ABE0F7E6565CBAC 524FAD13FD415729 E4327ECFFF7E2E7E F264FC8229C0FC27 00C7DFB51A170E63 C26EB8944A9EC317 F0731E77EB2F846E F121C0C61559D3B0 D80B90DF32B431B4 95CE6B24E703C19B 7977C69CE9BB3914 18283C2AC16756E8 3DCC34436F7B1683 3FADED6175E14685 3EF14C79D1D2478C 8EA3F409BA118261 402A90DF5CBC250A 287DC18AFBD35667 F8E4EFCE4AF1883C EB047FAD699A55C1 042A07489529798D CBC9778DB887B69D DBBCAA3E370A5523 410680BEBAFFB293 3B38A2EEA927B82F 9C3F72CE9C13BA39 2B23CCB86064964E DA365A9B162A1D1A

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231420 (name+title). Key = MD5(password) = 706a194be837dfde9064baab1d265dbf, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 89498e2d-e05d-7a50-aa15-661cf9c84d80
  2 390dec25-901c-1f66-a0a9-384779535512
  3 79f80a18-b6aa-64df-8adf-9c299cb1ea00
  4 b1176ac7-37e3-7940-8ab1-7f5f02020cef
  5 b6450ae0-52d8-25ac-8c46-2184f81c58ee
  6 98c95794-f3cd-0fd7-8e2d-a8a2f2e15faa
  7 ac5ea644-5c4f-1b88-8ea5-6b33b746dc97
  8 ed9b9100-860c-781f-bffa-30de9d650099

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 71672017. Exactly this sequence comes out of new Random(226).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 97 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related