201209241233 10djaw

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 636

Metadata

Post ID: 10djaw
Title: 201209241233 → 2012-09-24 12:33 on A858's clock
Posted (UTC): 2012-09-24 03:33:24
Timezone: UTC+9 · title 12:33 against posted 03:33 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241233) = 716b62e6d8b8a5f806dcc75f20739218 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(636).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 169 · predicted N = 10 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A3F40F6F0C7FE7EB F53171A46688F8C9 4306A8CAE43DB4AC 17CB107AD4329893 83C08DF3DCCDD13D B969FC2A21430BCF E1557E60D36C0F34 12F9B086F4E3244E 79CF11B9711CC47B 05C9AC4C7D2A746B 9F4E385D530DC2D7 04647E66D554A01C 9329CC000B95F679 D7552EA20A527450 1F75EF423E59C5BC F82EA6FF3D328847 E155E1AC262A8E1D 826D43D91123B7ED 748FD032571503AD 709B63E3C99DE37C 0EFA65B00A2253AB 53B5F5F52C71B6C3 95A29140F9EA96F4 E5D010D82F40FCEC 6EFB7110DFAA7103 0253E0AB3576419D 2D96E4753DBBDB47 4E6FB5334273797B 54FD5E83887D3924 0776C29C23C86C4E 0AB1BC9DCC281CFC 94407F4E4591846D B8577B6B85EFDD48 9137D7EB4463627E 7B8307B29D86D7AF 20B2B9356176A5D4 49ADD2259726D1C2 B0DE52D58EF6E144 61288290FB7FDA1A 1A86D2EEC58E7FB6 2BFD5FB8B8ED7EE6

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241233 (name+title). Key = MD5(password) = 716b62e6d8b8a5f806dcc75f20739218, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cbb12f13-dffc-8591-b96f-8d748bb00437
  2 b012848d-7835-37ff-896a-66bcefd5870d
  3 5aa9e12d-294b-23fc-b8d7-ecda402512b5
  4 67b9ee7d-79cd-20cd-beba-5d694a82a8f8
  5 b177fa48-963c-3333-a0fd-2ffeed1afd14
  6 104486b1-6703-37f3-a19f-ac6b378377c3
  7 791e4e5f-4293-77a9-b26f-17dcf013d964
  8 4aa8f31b-3501-4dea-92f7-f477db977a22
  9 d6c7ed07-4862-50fd-9f09-b7046438359e
 10 1d7eb824-53e8-7fc6-ad6e-603e1d7ac41b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8322337457. Exactly this sequence comes out of new Random(636).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 169 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related