201209241243 10djwj

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 984

Metadata

Post ID: 10djwj
Title: 201209241243 → 2012-09-24 12:43 on A858's clock
Posted (UTC): 2012-09-24 03:43:35
Timezone: UTC+9 · title 12:43 against posted 03:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241243) = 2943166f3b18688766504fc9f2e149f2 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(984).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 179 · predicted N = 14 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E33A17B628192553 097A22CA326C1A7C 9B14D53327208D8B 80DC9F5A157B86E0 168651E0756D73E8 92FA68F8323C7CA9 2D51C262A14898C0 6EBEBC9C33AD717A 75D4EF4291CB0131 93BA5420BB21F1CB 04B154CE086C4066 83D1565B1972962A C8913ADA811906AF 35693C710C750181 423C50F4ED96455B 2B4CA7D9633AC49B 54E52A540AFDBF5E A3CFC05995421554 12D797BFFA69351E 29075ECC48AE9635 4E9AC5098C91ADE1 59737E90C0D641E7 B2906B508B5B0FC1 DC53F95D0FF1B0B7 772DBE9C8C89FECA 3BD935C329C5ACEB 13E6C2E22875AFA5 4AE4B6626D192B64 A97167EE87C8D9A0 82961AA210C2BF49 DDE1BE6006FE7DB7 0AA96F90FB87B82A 3B628746026043BB FA6B9676ED38E2F7 422D6723E78821E6 45E640954F32A6EF CC50377A1584EA07 D3511B5AB9F23469 A51DF6009554AF0B 1B780795A756BEFE 811D9420CBCF9F8E 7C47B67DCBF93AA6 37CEA7395678989A 774B93A5B20EB1E3 55AD7CAF0DCDE2CC D8BB9EF1E91019A7 BA579C4E477EB57D E4634D5D4084D6EC B7AB3D5ED019544C 12D742AB4221395E 5BD482DCA9E42D65 950C20B34AB180F8 6D9F0D3C44B4F728 8B0AFA48ECC0C0D5 FCBE12A5CEAF92F8 57C02CC850AAB202 010CA9A93613B95C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241243 (name+title). Key = MD5(password) = 2943166f3b18688766504fc9f2e149f2, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1ac8647d-c563-7d06-a3db-358592f7b566
  2 008b7451-658a-463f-9db6-b9246b1dbc56
  3 e5cda521-1e5b-5e62-9342-dee783ca8f4e
  4 47594366-1acc-5827-a567-2c3bc1aad9ca
  5 31bfb2cd-a743-40c3-9d5f-fbf98b38177d
  6 0057531d-1f28-4577-9a2b-9556e7802520
  7 b4eb3131-28b1-7d17-849e-175164da3e5c
  8 0b97562b-a999-0dfa-b636-51049ac47cc3
  9 33f1ab63-2ed0-602a-b513-3670ba6e24ee
 10 a08d9927-bcc4-1117-9f56-f5e20d89fc7b
 11 88ca3a43-24d3-288a-854d-55c35595bd64
 12 0f789603-9d1a-66b4-9791-bd1c3aca5973
 13 8a80b8b4-1a9e-032f-875e-1eb8ab7e55a0
 14 9b086b7c-2243-3849-a78d-ec9ec476d83b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 74554470612603. Exactly this sequence comes out of new Random(984).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 179 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related