201209231451 10cogk

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 119

Metadata

Post ID: 10cogk
Title: 201209231451 → 2012-09-23 14:51 on A858's clock
Posted (UTC): 2012-09-23 18:51:21
Timezone: UTC−4 · title 14:51 against posted 18:51 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209231451) = 81c2067e3b11925c5b7b9e463f373c47 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(119).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 128 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

48157030FC74CB0B 68C8BCBCCF59982D 10C3337BABB7EFE1 46498D314172048D 531C2A523874B4E9 7617501E333DA186 62A969447AE883DD 4517D82F4DCDCE5D 5E1B911022DEA2B6 904304AB8B8F5F7E 69CFA8B5B168FAF9 31103F5867C74FFD 78E85810B09A4840 CB53D80139843B1A E0FB1BAD064FBF19 2DF2B8C9FD7BED2B 1332A27A614F2C42 BB6C3B246969B8A8 DFE11309CC5135BD FBA7284514387AA1 00C6636FFECA27B1 C4E5337807F0DFBB 9D41CA209EA78968 F816F648D5FB2039 3A0570EF8CF86FD3 85037A7858B5B392 50ADBD3CA794A79D BD879F94BC92409D F8962DA7789266D5 ECC9927C50F630E8 09F9A7A37C3A47F4 75E45F637EAFBAF6 020F75ED3BD56666 611D91698446523D 9D1D9CD6FD0C67D5 1FF9558A945F615E B6A06CC8F65A6070 7826913EFAF02EB4 67CF25A0A893B549 32894B0DADDDBEA6 3AB2BF20D7C8474B D132D59777AB20DC 0C73964DC5706603 37EC98FC243F2B27 E70B578B4CC660FB

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209231451 (name+title). Key = MD5(password) = 81c2067e3b11925c5b7b9e463f373c47, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c29c69a1-9a87-8310-aa51-f8db85a47a09
  2 e29c4978-c93a-667b-81bd-f5b197bacd08
  3 ed56a78d-299e-886b-ab9a-7201daa24fcb
  4 32d7c506-2d2e-886e-ac14-7a86388a50b4
  5 d597357f-c17e-85ff-a60c-27efd604262d
  6 c7cc7871-7be4-49f1-92d2-f68eb778ecdc
  7 9729d10b-845a-2d67-b721-bcf2b1448030
  8 6f3249db-5022-1655-a0ba-d00334ead319
  9 13db9c8a-6729-689b-bfe0-4fa7bdb270c5
 10 eb1088d8-ac56-1059-945f-710c7ac40f63
 11 4349b978-727e-829e-8eda-0fc0a083f2d6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 86888421618. Exactly this sequence comes out of new Random(119).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 128 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related