201209241208 10dhuj

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 313

Metadata

Post ID: 10dhuj
Title: 201209241208 → 2012-09-24 12:08 on A858's clock
Posted (UTC): 2012-09-24 03:08:10
Timezone: UTC+9 · title 12:08 against posted 03:08 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241208) = c470d394d35a71154216c7f1dce730a6 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(313).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 144 · predicted N = 8 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B5A29055F79ECEEB BEC0B454B14A07C0 D37BB1A6477A6508 127E465AD123A353 5D8F7BB32D207F89 275AE8FA1C4B01CE 497DF96F103109FD 7CC91C99C539A949 0E8426DEFF1DB0AF D66EA1447ACCB722 8B1FE3BD566ED2EB 38E86745F28F096E C8F8F72A73BE124A F176283D7D986310 A2B12FC64D72660B A02EFE25BA6246C0 64EE2FD4380BEEB1 D85C99931B9A38EC F5931CAC28DB860A F7E9E85920E1C018 78363A76F98B8867 D470F92B3C744737 45A428CB4F39F9D7 A514F55DDBA9EA3D 6EC8FE676D0166C0 6F9AEBAA22779434 33D86DB0F26A40AF 782FBB0B02809353 51F26456C3409C92 E2BEB9FDCF92D4B4 F74777628652C9E7 88E72A4A42D85A1B C5F1B68355000335

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241208 (name+title). Key = MD5(password) = c470d394d35a71154216c7f1dce730a6, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 465948a9-a0d4-205b-b52a-f38d34cc764b
  2 38e48564-f9a4-5a00-a351-af8583ff7181
  3 6c3d8775-f145-4213-9a43-b38929226878
  4 4343c256-7fa7-31f0-92e3-8cc648d07ac1
  5 c29688d3-332b-42ed-9a83-0261d7b88e47
  6 21578573-74a9-01e1-a56b-45f57f11587d
  7 3d96d2e9-2eb0-1936-9b33-046e35e823b4
  8 4c68c22c-b300-40f5-996a-b4de6529cbc6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 25434014. Exactly this sequence comes out of new Random(313).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 144 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related