201209241253 10dkgy

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 273

Metadata

Post ID: 10dkgy
Title: 201209241253 → 2012-09-24 12:53 on A858's clock
Posted (UTC): 2012-09-24 03:53:43
Timezone: UTC+9 · title 12:53 against posted 03:53 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241253) = aa579b7049dde500af16768c6d2a1586 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(273).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 189 · predicted N = 15 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

63BDF0C75DDF6A19 B18B494B6C8334D5 4DF62E3ADBD68518 D654E833F7CFCB3D 834E6798C99776F3 8594B1FE08DF7177 47E22B197DFF7E27 3660FA80223799A6 73F7B40B7644485B 1A75B4A4847737BC DFB17C619E32B11C 31E41511C5CAA2B3 6C13042C4F3CC501 581FCD5BCF120635 F7A876D2C675283E 3C6EFFF409A8B053 36BBAB9ECC721D7F CD4EE8E161987E39 AC5D4CA06E5299BF 33800C136D9F470F 0716D64172CE9413 66F5C9FA10BF3131 F842DCC22512CA77 7C31FB55C3382534 EE9FA80572EA6DE0 F9A6589A1C2C4625 E392F8F1D28FEC93 CC8F243411FF9EBD C9FB228B1171333D B90591F0F9AD3849 60F900347762D468 E8F9B802AF1758AB ADE122BAD5BF97CC 5BFEDAE493EBD117 733BBCF82B5E9E4D B187677FC14C7893 076C6797706B454E 1C391A32EAAD12D0 7C0A3178C3648D50 7BA9421C89B6ED9F F96257683F878D1D 0B2980DC21B242FD 07561F9A7E9350F0 5859DA77FCC4F122 8C3991735E89F923 A942508D0CE47353 8CD47A4BC07491D1 A5A818E8D766D3FD FA5C9A5BC2C7CC25 6EB07787342DA9FD 6C9E598471E6B365 3A5EA855F20911DA B90BDAAB324E30C7 2642EA6F8A9B9F97 D5757120DC4CBACF CB1C854C617527E2 8EF2A6E4D666A825 A42313B574D96ACF DD68C765FC326E35 5E75686E2A3F205D 8D2A0716065786D5

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241253 (name+title). Key = MD5(password) = aa579b7049dde500af16768c6d2a1586, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 df02a8f9-1e8f-354e-b3ef-74b1b41a9a1e
  2 e87711ba-f278-8d62-ad1e-072dde60ce91
  3 a31d03e5-7fd9-5b27-9fcd-9d47476adef5
  4 dfc145e1-9277-7a0e-8d87-47d367354c24
  5 34b332cc-7a48-43e7-985c-2c6ce28d4403
  6 450bce97-c3d1-1f88-895e-5c198da58865
  7 b798804c-651d-2a57-911c-796a1fc42ae2
  8 5fa5bd10-da06-336a-acbb-7e85fff9bd19
  9 375e402d-a6cc-6039-806b-4edc77e9babf
 10 dbcf5dca-1128-830a-9f43-1c872e399d99
 11 aaf5bb34-cc51-37b0-94d6-a45235b4b1dc
 12 08f062df-200b-5563-ba51-c08f07a41c54
 13 6f3a8ba4-101d-240c-992d-63d2e485b1d0
 14 4733d590-855d-4a16-a865-b7a0c291da80
 15 09d3c137-0afc-0f67-bccb-5840666b6032

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 385741236835240. Exactly this sequence comes out of new Random(273).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 189 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related