201208310654 z3my9

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 221

Metadata

Post ID: z3my9
Title: 201208310654 → 2012-08-31 06:54 on A858's clock
Posted (UTC): 2012-08-30 21:54:01
Timezone: UTC+9 · title 06:54 against posted 21:54 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208310654) = 67b6c49bbcf3da287828bca3346b57ae (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(221).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 1 · predicted N = 12 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

56C83B738C25420D 35A88F73A85A3311 1DF946671F6C1460 779DBF033F311860 20AFE6F1FAB9A303 8FD13947F2491947 59B40DF35403C86A 688FCA8BCA92C914 E36B02E99455B177 58591E7AECF16B9E 56B43E88722905E1 2D2744D2EC4BD79B CAFC52F2F19A3F1B 7B2D88CAE2685289 B1D2E7726620008E F6131963306C9851 6957C603E449085B EF231590791A66B8 521648B6322C9B31 AA8EB2463AAB0103 FA0298BA2132BCA0 C68A6A51A35BBAAB FE7BD14C1F3B8366 96CA38A0499D22DA 9E983C7134DBED51 44A7AF3AA2565002 82BFD047E729FDB5 B143654A175F16BD BA2C71817BE96AE7 73A7304151C0454C 3FAAB659498B0C3D 9EA10CAFFD841EFA 84EB0C57F0B2D5E0 9999BA9094BBBFB8 8F71B96C58196B5F 1710D20C8DE2C6AF 2154A7EEDADA4213 3C349BA457DFCBC4 6DF400106380D608 A7E5802ABF8CBB48 A3C4F551A071C16A 77C694B608C2C726 605976D78CA02A72 956B454B23CE702D E8880298AD2661A0 4D1CBAA23354BD43 6EC2418EF241AC49 C6D2ED751EB52F0B DBE182E3C68287AE

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208310654 (name+title). Key = MD5(password) = 67b6c49bbcf3da287828bca3346b57ae, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 08e9469f-b046-1995-a053-36cb44d4fba5
  2 847115e7-67b9-549b-a625-279f1fc730c4
  3 36a364e2-4e83-28a5-abaa-6901d44ba3f5
  4 21a78709-07c5-62d2-b646-08261b650cf7
  5 687af9c0-794a-8268-9311-2920a84bba6c
  6 c9747d7c-57d7-6cca-946f-ed449017a3b4
  7 0eeb347d-d178-8b77-a00e-c5be1f3116aa
  8 f5647aa8-8ea4-2cdf-a2a4-9751bf5ebd91
  9 70709a73-ef75-2818-82af-c2c38670c0eb
 10 6d128538-fd46-61d8-8d8b-208305f744b8
 11 b24525e8-f7a1-07c4-b916-858f181025b1
 12 2ec987bf-4140-0754-b969-667bdf50a0bb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 152686822600. Exactly this sequence comes out of new Random(221).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related