201209241313 10dlkm

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 679

Metadata

Post ID: 10dlkm
Title: 201209241313 → 2012-09-24 13:13 on A858's clock
Posted (UTC): 2012-09-24 04:13:57
Timezone: UTC+9 · title 13:13 against posted 04:13 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241313) = 9c954fb71cfc48726051ee059122f45a (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(679).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 209 · predicted N = 8 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B0D37B20CA7677E7 DA554D22F3BD1C0A 31C85368D0DBFF3B 5DA99D5544205534 255ECFC06F9DAE1E 639EB0F45185DD20 D039F5FDE8794A41 BDAD195C13BC23B4 2443818CBF18B30B 3932D1714D0A2598 4D1D4CA7CAF10AA2 E51E004FEC46B55D E89EE389C5B22D49 C54201CC47404B1A 608ADC6DC3538F59 D5A5221E1C1E34D0 F47A6BBAB980BF9F BB8B8ED5FA1BA340 C58619EF851851A0 FD01E68574E6DCEF 3708C54BF11AB406 29C07D46B065E3E7 9D9E7EDF29C91358 953785AB23B13D06 6EB9B0D05354C43F 56A0A31B4CC12244 D2FBE095DDECC0E1 6D40B04F33771735 1B92CB39632C5C4A EB4271840EB4B19E F2707D18FED1BF08 442F1E1F51F5EA5D CA7ABF2E5F864FEF

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241313 (name+title). Key = MD5(password) = 9c954fb71cfc48726051ee059122f45a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 66331d93-5707-410b-855e-5d437b2e0798
  2 e6e0c1c4-d368-09de-9863-39377518881d
  3 5dafabb9-080e-3e5a-b9b9-bf9156bcb7e5
  4 8c2a9e83-fd41-47e1-82f8-36ca5d064324
  5 fa217964-2930-601b-9578-ebdc7c9032b2
  6 52e3211e-4f8c-8cc5-b122-7004446d27dc
  7 61a2db75-2694-1f80-b605-a62f8ac62084
  8 ad0ea075-1789-0900-92d9-13391f7778cc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 40346810. Exactly this sequence comes out of new Random(679).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 209 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related