201209241300 10dkvw

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 517

Metadata

Post ID: 10dkvw
Title: 201209241300 → 2012-09-24 13:00 on A858's clock
Posted (UTC): 2012-09-24 04:00:48
Timezone: UTC+9 · title 13:00 against posted 04:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241300) = 57df43d4c5e2616aea1628ae193a0e21 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(517).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 196 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C60EF6762E8D594A 8503C63714B6B40B 8108FD2B96717AE0 D769E35947EF007F 71D224D38312A97B 268D8AEBC7FA75FF 64DB9B5BD2FD10A5 2B3D1F2E84E981DA 0170CCAA85E0A4DD 69E43994FC6359B9 8734A1614750F81E 7BD42084A9A01011 F6AC721EC03CD6DC C89E3914759697E7 75E8CBF5CF826034 D479609D96C16A0B 7F0584B8CC567F43 D624FC7064C36808 0C1F0CB815917061 FD2441CC054A2A1D 2ADDD633B1AC0971 F451635189647FD1 9E460BF79CA5A392 7DF6735F8880FFA3 D8E85F068A9B413F D589C1FC4BB95D65 DA247EDCEB477249 D8EE6D2E954D7A55 7140E3CAB20C7CD5 D81F9FC7229FCFF4 849A1CEAFD702722 A46FF7BA806B96CD 328C957485793E8F E8CA875479A15843 6BFD11C32F08EDBC 32B3BF8D6727265F C410BB047593EC94

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241300 (name+title). Key = MD5(password) = 57df43d4c5e2616aea1628ae193a0e21, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 01299bc2-649c-7e70-95dd-1e28cdb8a02c
  2 4a6605c8-5682-4e10-aeee-3b6e7d52052d
  3 c7cce3f8-015e-123d-823c-c6158170d32e
  4 8ff2f617-d379-8fc8-87e0-3d12d006ce21
  5 62ad5a2e-ec4a-5fbd-a911-8f9a29249c2f
  6 4db17720-4412-3b2d-b369-8af2d58c3b6a
  7 399a2442-dc6f-4ba2-8241-0041f8e0eb05
  8 1320a5df-f725-7a42-9057-68c258639533
  9 19bf4baa-e7ab-8574-a884-d85926373bd4

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 741853478. Exactly this sequence comes out of new Random(517).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 196 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related