201209241305 10dl6r

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 826

Metadata

Post ID: 10dl6r
Title: 201209241305 → 2012-09-24 13:05 on A858's clock
Posted (UTC): 2012-09-24 04:05:51
Timezone: UTC+9 · title 13:05 against posted 04:05 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241305) = b95b031d36b45b61ae7ff32fadc42fa8 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(826).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 201 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

056EF9D20DA9A037 B1557F89FB9C2087 693427FF68772F40 9D9DBC0947FBD5F2 C427AF528E37EE02 B31FDFB82077D606 295BB9144071222F 81C87498D40FB9D2 B2DF0F6F674EB0BF DB438E2ADF32D4A9 38B71C6AC67A80AA 11BE4E37C07471F8 DAC2E9DB70B61453 5CE31C0535AF71A5 C0FE4F1480690620 7E43E9BBAB788A1D 1E26C78E65EDE7E8 1719089C17A167BF 38EEA6482F4E7604 496A0F1D4C292742 0C376A4C25116946 D1460DA43D9949B3 DCC1877938A00A1E F93315F7ED3AC7D2 FCE31E7D9DDAA9B9 8C18A34D34F229F9 3A2F061D6B82313C 8032A611B893AE7A 3EB238D309E40DCF BE672B149CE7E866 EAA234952F4EE21E DD54747864CF21B3 71AE4E282AFE47A2 C856EC8BC8AE752F 5377971D32477E9B AE955E4DE78487B9 426C6E53960FC30C F01BFD56B803EE2D 54EC616FD393F0EB 8D07FBBDBE9F787A 87283ABF8C6EC40F 592738DD9AE85D78 000A4915012A18C5 3E76450140DC0181 7EA1226248EF5053 05CFFFED356B221B F5D920BD75BA5735 D102674925FFD986 52089D27DC7EBF16

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241305 (name+title). Key = MD5(password) = b95b031d36b45b61ae7ff32fadc42fa8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9b1c99a4-db5e-29e2-8b3c-da848852369d
  2 0012f655-0cb9-18cb-9065-c7283a3c187b
  3 814eb592-598e-1b25-b002-dfbb75ddeb7f
  4 0130a3aa-fdd4-7cd2-89e7-c60b9714f17e
  5 473a67af-70d5-1db8-b1b2-119536c505a2
  6 44a15e55-8d0d-36f4-83f9-e12f93d01048
  7 0f46036b-3657-00b6-bf83-6fc2d3e09380
  8 fc39d28e-e622-7e2b-8646-500544f334ba
  9 f320d825-b34b-165a-b5ed-44911fd84aa8
 10 24d3d061-c44d-7405-8574-fa06526d2f77
 11 7998866a-ddd8-7bfe-970d-7952715ee883
 12 104e11bd-2c4a-39ab-abf1-1ceeacfb9f07

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 211713071773. Exactly this sequence comes out of new Random(826).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 201 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related