201210120900 11d39k

explained decrypted filler

seed 917

Metadata

Post ID: 11d39k
Title: 201210120900 → 2012-10-12 09:00 on A858's clock
Posted (UTC): 2012-10-12 13:00:10
Timezone: UTC−4 · title 09:00 against posted 13:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210120900) = 3472cc40712073b62c79baf76a825c7c (name+title)
GUIDs: 11
Filler GUID seed: new Random(917).Next(9) ✓ verified
Run: Run 36 (seed 335,015) (seed)
Draw: 10 · predicted N = 11 ✓
Machine boot: 2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7908FD349D5C8026 CC285025A51E6B3B 6C6B0801C066A3F2 5AA8CEFACA1DC92B 07F3667341E6DF25 8DB75A694E9E6F0C 699B06F17ABFD7E5 ECE1A1703F5E67BC C01D60395182FC72 52A15349D205686A 3CC168138C87C639 F480CD6CA769198A BAAE5131ADF7D5A5 96F9979ACE7B8830 0253BDE25E14178B F9963908B597F4F4 5FAF1E995460AAFE 8E8F1D5E5A20FBCF 5C9F462DCF38F1A9 6947BB0755E6234E 2EFFD082595D15CD BB3EE8D44A20DFDC 45EA992502496E6B 0978C931B35B0B1A 6BCF531FAE29811E 4A7FCA6F80CA3BD3 D9413B4D76A78EFC BFA57E22FB095274 FE527D32D9E87F95 AC536428247695BF 01AE83EE52EE0887 2109DE535CB916C6 0310E180A0E6D444 F39A4FE1FF1B6F56 D4C30E14A84AA289 93E1FA154841D794 3BC55BD3995DCF60 B5B2595B30E09697 D839F047BEBC2426 A457C32DC7211CEB 9E5F4306E02D0BD6 5D19E1E25F3F3A7B 9475D63DCDFEC68D AFCC9304E2B74081 8B06D7ACDDFAFD98

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210120900 (name+title). Key = MD5(password) = 3472cc40712073b62c79baf76a825c7c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 edb38052-f93d-7f82-997e-f2aa2bfac4e1
  2 e64903f3-8635-7071-99e4-21ba9f8535f1
  3 bbe22df8-ef0b-6c0e-95b4-e2e1e67eac85
  4 253f34e3-7719-2114-b667-5f7e2cef632a
  5 32f937af-6b33-1f33-975f-4537c2a07038
  6 7a1176de-c322-8391-aea2-45d9f4ef0d2c
  7 8da72c37-8f74-6e3c-847e-683f0c97b481
  8 8aabe213-5bd4-4011-a483-19b524c0e644
  9 4ef30f35-2f75-3de8-a541-b203117b5d7a
 10 c49f2d4f-22ac-3418-9439-b22c9b23b71e
 11 8a98bf77-d415-758f-bcfb-ae0f72d1d381

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 77621864337. Exactly this sequence comes out of new Random(917).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related