201209231443 10co0b

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 98

Metadata

Post ID: 10co0b
Title: 201209231443 → 2012-09-23 14:43 on A858's clock
Posted (UTC): 2012-09-23 18:43:16
Timezone: UTC−4 · title 14:43 against posted 18:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231443) = 067e80235391a07683ec596db2660f96 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(98).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 120 · predicted N = 10 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

891D93615F5AA7B9 A53E4A9341F9CA1C 68D580878BAFBE60 B33E98643ECDD09B 91BD63BD9F974771 29EC59DAB63F0B35 D01E35DBB9B59C6F 997B0CEC8BE519CC DBF4ADBC9951CACF 09912FC3A6A2C6C2 61AE04AFE5C69847 339FC9BDB741BE9F 08C35622BE40C24D 684CABD43B65626B 7198C68240EDFADE 2DF3A96E6428AFA4 66BC7F01BD8ADA55 20D5705D0B7F6005 5B68B2641E9D37EC B6DDC79332185BA1 80C7F90672A08FAA 51606F446379DFDA CE4EF41C4574B69C A92F9342941F8962 3508981DA61F0DDB 059F182FD345A1BE 9EAA31FFAF4DC517 6ADFC4741A3241BE A8EEDB1D45624258 8CD4BE7E7A2B9D45 EC7715638A448993 7CB90B2D5CAA0B81 E456DED7B79C79E5 68D06226CD5A5BA9 55360555FA066E65 FAE6F2D01274EBD2 EFF936A16ADAAB74 DB849627DD9FE7EA 50DFB05E8FC73989 9A8CBD83F9F23AF6 3E59CFC15C3157D3

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231443 (name+title). Key = MD5(password) = 067e80235391a07683ec596db2660f96, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9826b437-0d1a-8ba6-a039-1e09a101f5ba
  2 4d9ca721-fd9e-5f18-b8e5-24b8a234fdcc
  3 c9b20259-ed9b-200e-b1ea-e932b085ab05
  4 932986b6-e501-45d7-867e-f34c55703d52
  5 944723a1-513d-4ee6-b541-1ac3a893ee33
  6 8e3e074d-bddc-189b-a8f4-8746b668fe6c
  7 8d6a4b57-d8a1-70be-a9c0-9b51979bb823
  8 a8594265-9bfd-55bd-befa-c89d984557bf
  9 bcc516dc-364a-06e0-906d-688dee9c919d
 10 30a212b8-6f04-3a0e-b8d9-d047c1fb1bec

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8524417503. Exactly this sequence comes out of new Random(98).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 120 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related