201209241431 10ekcs

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 24

Metadata

Post ID: 10ekcs
Title: 201209241431 → 2012-09-24 14:31 on A858's clock
Posted (UTC): 2012-09-24 18:31:32
Timezone: UTC−4 · title 14:31 against posted 18:31 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209241431) = a6ccebe834994cca232f65005fe99302 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(24).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 256 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

381CD27ED9CEE709 2CE43829F8C134C4 88BE5E7E8937D840 24DE48816CABCA2A 214EE088D33E1A35 5B91F803BCF38D18 E92206199A6F4EAA 01324B7F44691C30 7077AEB2D6DD0144 A98F820E79076ECD E3B388422F271A4A 56565E92DC7C5DC5 7FBE3AEC871A0622 AA57548D49ADD776 832965EC70914C9B 2F6191E24F1A4B96 32910E2AF1350C08 B2CCAB5CD3C53B0B 6052E83F25BC66A6 8EE3F2E4745F54AD A25B69DB60F0C0F0 0B2E993396695A55 51F6B2C807EA6422 2FE240715B925F9E 8D88D8D7743C163B 727C5F5C600DBDEA 05F8FC31ECB19E58 BD04CA2B8FC3B22D E9040F063753056B 780CE5F43DA0732C A8304EE2A50F5DA8 305C612EFAE03C13 DA2698C07FBB3397 BA3A319F61C9F617 E846619D9F2DD058 04D3C98408BFE9C1 502BD696DB2800EE

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209241431 (name+title). Key = MD5(password) = a6ccebe834994cca232f65005fe99302, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9155477d-ff5b-245b-ae36-0c1a1fdc0d83
  2 f1873318-e872-7baf-8f16-3e0a4e38ec0b
  3 40bf2b52-8234-4c02-b656-0f37a9ec095e
  4 7467f186-d96a-6f2f-a9f0-c22304c79883
  5 a992b5b1-0dba-0f29-8cd5-2b2ea6117178
  6 dd366712-6a28-4c7e-ac9e-940d8c13352f
  7 68e53c17-ba32-54f0-9ae7-19d4f6654600
  8 cb1af9ca-b87a-4bee-b183-f7e40ced6599
  9 9f105945-05be-8d04-a2f6-705e3496ebc5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 274604548. Exactly this sequence comes out of new Random(24).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 256 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related