201209271330 10l9k2

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 894

Metadata

Post ID: 10l9k2
Title: 201209271330 → 2012-09-27 13:30 on A858's clock
Posted (UTC): 2012-09-27 23:30:13
Timezone: UTC−10 · title 13:30 against posted 23:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209271330) = e741044c7abeaadc8da92132bcc9f988 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(894).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 272 · predicted N = 9 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FD34C0E97CF902A6 434844A82BB839E8 905A6F73A1478A39 C4D1251BF9F8DE3D 0658D708AFEE0115 A17384DDD5B5634F F88A8F054AD4FFE9 0AEE4D34C3601417 3C0964B645A12031 6A9C368D9E720DB6 A59264FC0D29EC9D 06B6BEB84EB284EE A416EE68C0778289 FB4ABA1858E4D970 B6B87E0014B82D25 5EC2392A51B7718D 2E1398B175346E9C 1A4AB354DC42B6E9 A603BFF590B51454 1D4832C6965BF3B0 492662A976149CA0 A87913D5441A5B5A 7E6A657285382BC8 62F30733B2B00E06 6163A39ABDBD276A E15C79FFFA1FB4BE 820EA60AA8D5178F 1EDE93C7347CB166 0D3CF3C48A3BF416 57AE001E8B1685A9 1F96414CD43837BE 82AC25E6C2904577 4EA926FC43B0F300 5A4B65764D9030BC B8AC4FCA3CB8C265 1454DC615F103709 40AA290FA981DF51

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209271330 (name+title). Key = MD5(password) = e741044c7abeaadc8da92132bcc9f988, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5cdc9d0e-f8fd-66c4-8aed-0981c5084164
  2 6d270d76-92ce-14a8-a569-e213d5ea749e
  3 0e236b96-4201-5a1d-9028-3e0a457027e6
  4 064844a6-fad3-3bab-9a25-9b7c631d53f9
  5 659e4c2d-b495-738e-ab63-be70b6401ab5
  6 71497a0e-2a5c-7ec6-a54c-106903627869
  7 890a327e-1aff-4a0a-8957-13bec87b8c4a
  8 400709b0-381c-821b-92b4-40f5ec33d10e
  9 26bc009e-82c6-577c-a33e-59400745c36b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 615377485. Exactly this sequence comes out of new Random(894).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 272 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related