201209241224 10disb

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 674

Metadata

Post ID: 10disb
Title: 201209241224 → 2012-09-24 12:24 on A858's clock
Posted (UTC): 2012-09-24 03:24:19
Timezone: UTC+9 · title 12:24 against posted 03:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241224) = 41baf211ed9e6ba1615dabd8cc5d851f (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(674).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 160 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F86972EC12695343 F7C60EF018234B7C 69D4BECDDA5C0492 706CEE06469EAC1E 9860A88F61F21B15 A5E3185F3DCDF571 9F7CEA999185DAD0 AE72D030F27CE82A 7A9BA71106EC7606 66587172AE5B341D D53BB99D6A04AB34 2DD74D026CE97E08 B0A2BBE750E0C239 4ECD226F7FDBC906 15AE43CBC14B4665 9C3B72EF17E5E17B 1B7CFD39806C9512 348481C6B0114D8F F96D8BADB0AB8350 841FD3D5433AC523 91BDB15E7A0DF69C 9AA652AD80FBFE03 2F6348ED3CCD5E13 F7D8E29B149EB99A C73838DD8C7805D2 84904DC38CA40167 387707FBEE84E015 BA0814180A30DC1D 36F1367D83FF28E9 26607B1749ED3ADD DFD5E458766BFF8B BD31E3EC4EEA757E FB7C258910BAFFE8 1AD621D44D7B08FC C336B572315AA2FB EE4685E17E8802AB 01D232D18236D865 D7F55271455D9BCC 34AE8BB1B005F634 BBBC01857790F376 CD295CE55A80ECE4 6C588841FE20AE27 3D8B6210E6D1DAD5 782B71761AEC85E3 0302C7543BE49C8B

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241224 (name+title). Key = MD5(password) = 41baf211ed9e6ba1615dabd8cc5d851f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4a8026de-8e4d-7b5c-b017-4c2cfef41b18
  2 ef640615-9d6e-56fa-8429-6a276a1a5572
  3 39638f42-6da5-7ad1-b986-be27e9cfe419
  4 62d384fb-0428-3b7e-9ff3-af1bcc55a296
  5 48f95008-42e1-4b71-8796-99e65f186311
  6 1f5ecd9a-bbbe-5562-b2bb-a8902f9b64b7
  7 7ede2d54-2723-8967-8735-cde635313348
  8 73407310-91ab-5bb2-a698-71e9fd44b9a9
  9 a1fbcf50-891e-3e38-b370-80c5ee60c33d
 10 b59b24c9-f0ef-78e1-8134-0721fbe8cee2
 11 b098aea6-6660-7266-950d-2eb976d70d12

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 75734585377. Exactly this sequence comes out of new Random(674).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 160 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related