201209241327 10dmag

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 184

Metadata

Post ID: 10dmag
Title: 201209241327 → 2012-09-24 13:27 on A858's clock
Posted (UTC): 2012-09-24 04:27:05
Timezone: UTC+9 · title 13:27 against posted 04:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241327) = bbbf2b61431b1efc61482cbb587fbaf9 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(184).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 222 · predicted N = 11 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E9B120C8DE035E4E 706C850E41D41DBF 1DCD6143B7B3AEF3 EB78DE4EE86CFD58 F586E359234B1F8F 50A05DC802FA4DC8 5305EA1A73E6F0DE B6AFBE43E9A42BE4 53DD4917CE2FA6E7 014CC1712729710B EDA35A447E2D177D 4E3346FAF78A56D2 CB69F809CEF12090 2EFB8BD822C3E21D 86E48EBFF320F978 273FF0079257718F 106F4FF7C1C25302 A4AC69644971E15B 374C606B3C6FE26D 6055C1FBED3DE5D8 6B6A931AC6E247F2 BA76A6623A7D34A9 BE753D423986D2F7 A33416AB49C5C59F B6FED7EE9803FC88 350C78D1BD49EB96 5546A4B451C0B84B D23F919FF33E619D BEB3D5BD87708913 36900B87F00FA2F1 1E983FD2DD815A83 EADB1BD1558B86FA 3DE2BAAC1390A7B1 4BAD9658514F5D4F 9D8DB691AAD31C48 003F504F3E3C012A 4B0BB975C63408E1 91A66F534FBE5395 6A24DB37FFD28397 800401E922A49DCE 5C444CC830212071 D21B7891EBAF984D 4116C6EE991DEA1A 2263D3943FFEF44A 9E0247701128DD1C

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241327 (name+title). Key = MD5(password) = bbbf2b61431b1efc61482cbb587fbaf9, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4e64425b-a246-71f1-ad21-f260703fdbab
  2 234d7566-3307-7c92-a25e-da226cd7063c
  3 82daa148-0301-3996-bd87-7ad871d14344
  4 8fd97120-4b6f-794d-b488-e970d5116d4e
  5 8caa2a4b-4fca-2936-b41b-30e66fe953fa
  6 e6c44e0f-eaf7-3b94-a060-b8797965ca9a
  7 b7359c76-1dd6-3ac1-a730-acb4b45b5359
  8 2529974c-9947-6045-8bbb-84d7a5230013
  9 019a3004-3451-62a3-adbb-062c4071fc68
 10 eba7bd3a-26b8-199a-a83f-c06a6c2a2fa4
 11 9eca942b-632c-75e0-8a4e-4b81cf9dea90

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 77372336617. Exactly this sequence comes out of new Random(184).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 222 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related