201209241320 10dlwb

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 190

Metadata

Post ID: 10dlwb
Title: 201209241320 → 2012-09-24 13:20 on A858's clock
Posted (UTC): 2012-09-24 04:20:01
Timezone: UTC+9 · title 13:20 against posted 04:20 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241320) = cd08f4b58fc11e954ac07fa1444da3f9 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(190).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 215 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5FF12261E19723EA D48770B74D727941 E8BA4732037A114F 112AE6B0412E42A7 FAAD8C7E5BAA4985 623BA7DFF653546D 66CDCE6D484AEC77 A679F39C62E85D42 D81DABEE361AB1B1 0542A5CC13D89DBA 8A5669A6B9242F74 71886A8C1393EDCC DD006D5E1602687B 30EC7A4F9D46B3D8 6C808229E986BAE8 8FB8CBB6C0893B91 764BA9DA99F97EA1 84766C4D3B5A2099 3B239ABDF3120263 6031E32E551F7B75 B2F94ABEF61BD63A 513CB5D1765BFD61 82753C392EFA85AB 21D835B3BE679730 40FF9FD8AF362A60 1BE65ACC7A3DEA59 F49F547BBB6635C0 1F35CBD40AE363DD 43DD6BDE2B4C7023 B2AF747C655EB950 474CADBD8AE37F3D 3949C3D8CB4CB992 A94DAE89A20191C1 83CDA312BDD1D5B7 39479FB358510CC0 86789EFD0440068E B319F40A1CA2D777 02EA5CBF9469ACC7 47405A5332271ACD 668ABFC81DB9DFCC E3298D7476EC3DF2 5569668BBC7C8E04 70EC6FA7FDE42125 8FDABBE264825AF5 7C3F757AF87BD57F 0958D7C4E2465B92 C17B6AD2D56BD064 CBA76A6790FBE0E6 0F0C24FACE209D0D

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241320 (name+title). Key = MD5(password) = cd08f4b58fc11e954ac07fa1444da3f9, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fdcd4ba6-84aa-8389-8253-3835e6d9a42c
  2 7be364d5-a1f8-5d4c-ad7f-5376b59e99f9
  3 d6e160b1-1629-5ce5-9d20-53af2b704af6
  4 173b6c5c-b549-1c2e-9240-f90cdbcbee38
  5 80d17b8f-5777-8928-b1bb-368e62daa05c
  6 0377017f-3bae-5d8a-b6f3-6e179011e7a8
  7 d9ca5d0f-eacf-0bf6-ba26-4d26a4c34f27
  8 60b3bb43-d5d2-68bd-820f-2e4ae834589a
  9 02cf2673-c492-4e59-909d-2aade7bd044a
 10 b5456d30-34f7-3b0a-88c4-83cb1bc55185
 11 9eff48c8-0fd4-2917-9da0-31a34eb8f588
 12 bb34e19d-ad39-7f8f-aa28-3ddd93cc32e5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 855185064327. Exactly this sequence comes out of new Random(190).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 215 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related