201209271400 10lbgl

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 761

Metadata

Post ID: 10lbgl
Title: 201209271400 → 2012-09-27 14:00 on A858's clock
Posted (UTC): 2012-09-28 00:00:14
Timezone: UTC−10 · title 14:00 against posted 00:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209271400) = 9dabb25374091b11b7263fc1b7883154 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(761).Next(9) ✓ verified
Run: Run 34 (seed 83,105,000) (seed)
Draw: 273 · predicted N = 12 ✓
Machine boot: 2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1DD690E703A7B90D 80CFDF9834BCDF16 4A8AC3056232CF40 98290E73CD6C87B0 67662F8F8E6D68E4 31D3EA8670A6BB73 79E8AF4641E942F1 3A5A00EA4184824F 71F7AE268DC1D59C 17EEAD5AA7C60709 15A58436D00D4992 D382D4C19BD93511 B3D4BE3C67529A7E D4D6287277320DE0 9415869F5C790194 78056BF256D6C746 7B50CE09399EEA35 B8CB9024173BDAB5 9E7AF3F7AFD06C65 07F68C42B93C3B5E 0D84546BFE19F1DB 13AE09D626F22603 EDD9062171B59406 FE70CCA8DBD0B9DA D8781A43C9E9A448 14C8CE1F9663C897 0B2BAC2B04DF8827 33B49EBC8A99B4E8 CEBF4A0F5E1F7FF6 569E0A7436983934 766F264D0D16971D D80FDBD6FAF923E4 8FF026FB7A272B10 78342C17ABF86B6F BF2E8DE1732F2393 216F1D7BCAC2DC4D 9D09CFB1B56A731B A79897C6371D9D38 B2E87EDAF7564ED1 24EF554D33A275A2 3CFA0B9938BB1D72 E546C10F4E44C1A2 9D7E7714620BAA0A 12B9E68E8E2AC0FA D816393A833EF08B 98B6D4DFF16293FF 585166B92DA430DE BBE8250D7502FB39 E600337F81F43CC3

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209271400 (name+title). Key = MD5(password) = 9dabb25374091b11b7263fc1b7883154, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2d4d80ef-8cb7-212d-af60-76578b7c61c3
  2 91c543bb-a45c-0b6c-8903-6b3ab3c58b0e
  3 87841b5b-d189-6ffb-92e1-1c557ea8e69e
  4 91eaf070-8333-8e2a-ae36-89751e9f5268
  5 94936bac-a089-7df7-b9a3-a06afa74697d
  6 3eb5a967-81dd-52c6-a77a-4901cd5d574c
  7 428cab78-e773-7a94-8600-1e32ffc06ecc
  8 93f2bd3a-35ef-24bc-b2e6-99001fa1cd4c
  9 a6fa19eb-2670-192b-a30a-2e7de800f53d
 10 b1d9833f-1138-8176-bddb-bbe9f0fe17bc
 11 84253166-b3fb-8830-a9ca-b9972abc9406
 12 a0996a8a-3f26-567b-a68f-127a3410cf33

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 206875721885. Exactly this sequence comes out of new Random(761).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 273 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related