201209241302 10dl0s

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 16

Metadata

Post ID: 10dl0s
Title: 201209241302 → 2012-09-24 13:02 on A858's clock
Posted (UTC): 2012-09-24 04:02:49
Timezone: UTC+9 · title 13:02 against posted 04:02 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241302) = 034caf98fa9428ff9f61db86ad8ba69e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(16).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 198 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3CFABE83A03C3127 8C518DBFF2DCC6D4 55E64FF31720F949 B0FAEEBABAFB5B8E 0B39F218174EFFA6 7665C48D87B5CC1D 9CD91E05097F809D 0C8C9F78F5C98B29 2E715EF4766B1C0A 3DFFC665F3484D84 2D7E6BFEFF5BCD5F 4D4313E32B553A6B 3C754A3941AD74A3 78F9E04531F569B5 0180BC333F1D8900 82CFE9A25333670A 18CEAA98508BD9CE B15890F67F6522D5 8577CE37D642EAEF F49F505A2B7BD01F 49A0D955A7DAB2F2 05C9A4722279D6C5 87A7BBDA13C0EE0F C979904FFB510840 A89C42266121F369 72513A4A46FD8118 5C7DB55E9D692544 258A78F517E0F1BB E0274E4836147BA4 DB2E7E6A3949BB3B FAA6FCF62D6C6EBE D4A4D55966D6C952 2604DA9F88A7531A 5DC4DC232598F290 50DAE368911E899D 68899BD5CD0F584B 6A4359EB039CA342

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241302 (name+title). Key = MD5(password) = 034caf98fa9428ff9f61db86ad8ba69e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4072d0dc-521c-0c36-948c-de50290a7a98
  2 7065b402-7d69-45ff-b000-e384d239301c
  3 a4d9d82f-ca69-877c-823d-3acc06b0b9fe
  4 04bbea63-12fe-8a3c-9a8d-3749c171347b
  5 2eb62b56-99d0-3e42-bbc1-ac7729db3d7c
  6 3676f0e6-58e5-4688-9a86-54e6d937a2e2
  7 87d70417-7528-06dc-9ef8-736399593567
  8 771eeeaf-c4c2-4c79-b985-094ef35106fc
  9 2c211948-30ce-879c-887e-f965cc43e5fc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 048834048. Exactly this sequence comes out of new Random(16).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 198 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related