201209241411 10ej33

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 756

Metadata

Post ID: 10ej33
Title: 201209241411 → 2012-09-24 14:11 on A858's clock
Posted (UTC): 2012-09-24 18:11:09
Timezone: UTC−4 · title 14:11 against posted 18:11 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241411) = 29f600cbc9f6fdaf00fab74748c76910 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(756).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 236 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AF7A03577471BD52 512BE6C037BCB2EC 1B91F7A038045D6F 9CFEB31E361DBA68 F775DA862D6EDC88 A61703A2336866E6 5F0F7173B19732D4 957B3C6756486E02 2020D826D63C8042 C7A03C01F23663F1 552B8CF096847196 F35C18FFD0E063BD D4405586C3C1E29B 7FF0884C7B155829 86DB7083B120AF24 C2404D61FC25B8EA D2496FA62219261B 119C632A33247DAC 9A7F36FE07F929FF C6955EC05E1B9CA8 FD35BA20FFE86CC1 82584691E1CB1018 C09EC27882942E9F 028C0ECE6FD5C00D 9DFDE8B6AFF22ADA E3B32C6A0E4467AE 3DC3D424C2BC5FC6 840DE85338C7A7C8 897A13919B51C756 65BA7EE052D8CE5E 8D940F2BBD3701F0 0F3F24C91E756475 7380E9CE6399D1CF 5840CB92B8920CED B12026432308DB9D 3B842048F6876DE8 472E9CA88AA20E19

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241411 (name+title). Key = MD5(password) = 29f600cbc9f6fdaf00fab74748c76910, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cf7357d7-5922-66bf-9312-a98b64387cbb
  2 20b186c6-e66e-5002-a8f7-df56beacea7d
  3 e9d1f311-6502-1f58-9e3b-ef08ecdb6f85
  4 64a19b75-4dd8-8a1b-9e5b-683ad3ecec20
  5 1f08eee9-be5d-41e6-98ee-3c2f14adb5b3
  6 3ca8b9f1-88d0-21c2-a9b7-8e51bb636a22
  7 47913166-1a3e-563c-ad54-d943cffe8e71
  8 4b08d786-1e08-602d-ae0a-c239d7ac195b
  9 edca1b8b-7848-4d92-9e21-0d95253d374e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 651842564. Exactly this sequence comes out of new Random(756).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 236 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related