201209241238 10djlr

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 910

Metadata

Post ID: 10djlr
Title: 201209241238 → 2012-09-24 12:38 on A858's clock
Posted (UTC): 2012-09-24 03:38:32
Timezone: UTC+9 · title 12:38 against posted 03:38 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241238) = 1b8b968b678383a62e613f8ef5c307bd (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(910).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 174 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7BBE32C3340B3420 53E83AE642266E8D 4C31A94B34CC0D47 7B1410CF06E3D669 8D46C437294CD137 A47784F1DF961C2E 302FFC99A369E13F A38A5EED51E08FA8 58034DF41DA06787 B183405C49FDB6FC 278218418A5B5ECA 4043043E5D64EB17 722B4BD270B21993 FF3F50B0E762C0A9 F4D1671604C070C3 8DE1CDCC01240CE0 7C7EC0659503A5D3 7104532ED8701060 D1C37875DE5040A5 FF9CD4FC028C8E34 3078316FC323E32B 14731E863D6CE127 380AE241972846E0 7D6EA40F32AF7D29 18F191C3E7744DFC 294A81E29B574C24 857DFCDDAA311FDF 92ED9320803C1CE4 D47C090EA8255938 BBE5B1D20890FD32 86E8A5FF53A877C6 B4E5CF05B86D2624 2FB779C07FB9B119 A2D14E4C5F03E81D 9B0FE4F616B12C9D CFDC1A7181A6EA86 825DDB3F1AAD556A 8A6162E35F8E21A5 CD6F55A328C2A6B1 72599E5556C7ABC2 3F20FA9D9C90B2D8 00919F704AB12857 C3C51AC10AAB6BE2 5149F77320EC7C97 DB814CD14F75D886 B3CA70C011E68569 EF004D3E18737876 99FD9CE830323E91 3CBD567FA8A0DBB4

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241238 (name+title). Key = MD5(password) = 1b8b968b678383a62e613f8ef5c307bd, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c9331d77-7642-1c9a-ac0e-2ad1999e9742
  2 4ffefe47-c2b2-730f-ba56-9b0941e6d76d
  3 7e6ac6b0-6d6c-7cd4-ba7b-d41fb136af70
  4 7a6d3e57-354f-76f4-8c24-5c8e9930938c
  5 ae7b88e3-a919-0709-9d83-27856794f555
  6 21a77f32-792e-79c6-9cca-bd6ecf75aa57
  7 96d98241-d4cc-5532-a810-3585506edd9b
  8 e93c1965-6768-8437-911e-72210b09bd23
  9 9400ee68-8d3b-5bca-bf30-2239b128c8b9
 10 a434a0a3-b617-796f-a460-01631d7afd18
 11 ce824087-28a3-6b6b-9d98-8415d1eba940
 12 e709f6c2-b0f7-8652-ad63-45f43efecadb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 177707585768. Exactly this sequence comes out of new Random(910).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 174 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related