201209241246 10dk2m

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 28

Metadata

Post ID: 10dk2m
Title: 201209241246 → 2012-09-24 12:46 on A858's clock
Posted (UTC): 2012-09-24 03:46:37
Timezone: UTC+9 · title 12:46 against posted 03:46 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241246) = f1e39fe9c5742bee132e2efd542905e4 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(28).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 182 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

EDBC26245A6EC735 90796CA4DB7B6195 9844EB016019AA10 E7FE4EE53812D0EE A9B2C34C4D0479AE 70108BC23174EF57 19381A9ADEA835E1 1BE2CC604C986860 8D60387618B46AD4 80769556722270EA 5DF002A719EB70AC 11C5FE856931CEE2 F8C98FCD4F598648 0FA08BCF08CA168E 79DE5565E15A5B9E 5CE16CAD86C2C5B3 4E84CCA35654161F EF7EB03C2C8F2FA2 541FE12BC643856C 530BE15A2F02F005 AF77FADC21EF216C 5A8E66607476C883 E64B2AA8773AA427 38C651490714354B 779CB86E678FD3F0 EDDC6918CC1B0825 864E95CBAF7D744F 1E29CE3CBC1DE6D9 84F22B9882C7C815 AAD14FD1EA4FB8A2 35F9922E21CD9267 D8DFA26657DE2C22 5E0994628E049D8F 553CA8B331F0F47A 4A2859837F25F7FE 311FFF7E192025C3 E853D11BBE895DB3 FE9F5B29E36F408B 4D0E06CA9B527BD5 76690DCDF301F454 7AD6637EED95D405 78B76F784922F091 E5EF9DF959A92CD0 28C037A74AF29719 663FAF78FA998DF4 C2756D1C2196A901 153F3F5838AD3BE0 77991D040F6EC9F4 ECADB4E4B51A8FD2

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241246 (name+title). Key = MD5(password) = f1e39fe9c5742bee132e2efd542905e4, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 32ce4f0c-6f40-3598-bb3b-3a89555c86ec
  2 461b56bf-72f0-0644-9d5a-9d147e7f6619
  3 cbf9d954-2649-3382-9468-9e7b40b84f33
  4 8104e1e5-359e-4b77-8ecc-fbe260d0ed59
  5 759d4a4f-0639-7081-a1a5-266466b17b6d
  6 69640f88-e520-06ed-b8f9-d8a920664c13
  7 2f846775-0d03-43d0-804f-4475a482508e
  8 faf0e5a9-2317-49ff-aa4c-4cfa53271bea
  9 4ae61ee2-8471-3726-9588-9493c9cf2c22
 10 1fff6258-49e0-58c5-b9ef-f4aab2757818
 11 e28939ca-f58b-8ab1-8df6-d5605eb5b06a
 12 d90c8be6-bbb9-29a0-b15d-fa956195a011

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 303470443582. Exactly this sequence comes out of new Random(28).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 182 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related