201209241329 10dmef

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 444

Metadata

Post ID: 10dmef
Title: 201209241329 → 2012-09-24 13:29 on A858's clock
Posted (UTC): 2012-09-24 04:29:07
Timezone: UTC+9 · title 13:29 against posted 04:29 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241329) = 5f49229b756c0719f0e23864bd1e5138 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(444).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 224 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7A544914F331BE96 D28FA2D9AF155ED5 CE56D061F664781A B0C08BCE594F486E B0AECEBF82416CF8 EF7556287D7DDDD3 D4D21EC01B09F940 AA559C99758B8137 76C5BB8DE6211962 F0253DE9A0E2C144 567CD2C7062E1229 B3243591257A8533 53E30E24CE2EDC5C DCC29FADD43CDFEF 6F5336CA4EADDA42 8B5D8B9D6B3316FE 9C4E50F06B57EE72 8104F98BD650E6A3 EE0DF742BAF043AF 5B00E954D0EFCFFD F1412A872E75D6B8 62F04F82318CEEF3 ABE71DC8105A9F69 A8310EB1AEC43988 C0F332B99E02FA4C F058475763E33F5E F845ECC1467D90F9 01D2DBDF78EAEE4A 227A386A45E5E8D4 DD68939C7C5C0CAB 057D36CA10441652 5A0DEEAEA4B1C858 5D7D8BFE5DBCAFD9 8877AAEED6A27D6D 6B1E4B282BD2CBEC 90BA08BE4B554547 22AC191EED2A6437 7CA09D2B51148EE7 F8F59B329912D3FE 42D59DE158E594E2 E52452A62E54DC95 5AB1319582B74D2A DA74A66837DC9CCE F1BD4B7702CCE44A 111D183E6F2C7C93 648627ABA6144CE5 9A88292D64D5F3A5 8E5EFD770E160B0D 6E859DF8C774D933

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241329 (name+title). Key = MD5(password) = 5f49229b756c0719f0e23864bd1e5138, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dc80a287-90d0-6dd2-b166-9752895d349f
  2 2eb5aba2-2e4b-0a94-b4f7-d0dbb7516ecd
  3 aadc4fe4-0dc7-1a1d-985a-884a3cc6edd0
  4 36646c89-f418-24cc-b48d-2e88787e15ef
  5 db7e89dd-6fad-5692-8ce2-055ae221bbc7
  6 363f9634-f202-54e1-8148-95f15ce931ac
  7 ad3a0c2a-d63c-70cb-bd13-b4c8dbef2beb
  8 109c1dac-91e1-136e-b10d-35ce6e1b6f69
  9 ba4ba9b4-c437-8253-95f7-671f317ede7b
 10 b85e01ee-221d-8dc3-9fd3-a69feb590e8c
 11 aa93726d-f478-3a5a-a7ae-da99248071c9
 12 6192a1ae-f814-08c3-917e-26a72d657cc3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 601255718830. Exactly this sequence comes out of new Random(444).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 224 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related