201208310655 z3n0x

explained decrypted filler

3DES(name+title) ECB, 25 GUIDs, seed 283

Metadata

Post ID: z3n0x
Title: 201208310655 → 2012-08-31 06:55 on A858's clock
Posted (UTC): 2012-08-30 21:55:03
Timezone: UTC+9 · title 06:55 against posted 21:55 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,616 hex characters · 808 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208310655) = 089d932b55a9ddf0dc0118f99e96f345 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 25
Filler GUID seed: new Random(283).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 2 · predicted N = 25 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E20997092C205CBB 3A8CCB06D6843AB2 19CFBB18467B1B33 911DF0028AEC35E3 916BF6CDAC19CB6F 917B42ED869F854D 784EE3B10161EA26 88C472091DD38E9C 1EFB357DB15951E5 FE5940190ABAAA8A 3609329D3BE248A5 379481838A2311F0 AD4B41F1B030F82D 0ED68878C9C893F4 FC96CBB79AA2990A C5843DEA16C4552E CD0EEDD209937B3D 31F3267A9B2B9151 149CE142AA3733F5 F0690C974EDEEF72 65B8DF08353BFA15 A0D43159A1A201AA C76A91A688317AE3 67AAF4A33436AAFD D08A8B6E6573754C 1DB11C2F5C10A508 72C74164DA033684 C1F0A8E07C6E0F93 82E4600BA1957F98 8238A4F7357A7803 7ED977579C31D13E CE6C6A54F997ED51 3F1483E468AF252E 34721BA9A337AB78 FC8226A0246D7D9C 510E40A98E55427B 5439DF982F959642 5D55A0A8AF629E60 6835E9E246603800 4D9DC4FC10D5848B E3C5CCB76E8DF9D9 D1838179D803B879 B50ACCF727628E9A 88F648EADC127D5E 686C8EC69975581A 62943FED72B993F9 43F3A1417FA014E4 135C581F0BCEDBBC E1CE048282F75D35 FA466F43F6BC6E4B 29753CD494370BF9 F8A316F2D2FA6274 09BEA44A5EF8B90B BAFA0779E94406F5 39BBD54DD8A47C15 6E5B24B02CF793FB 49F59994CE626727 9F49A384AE8BBC7D DCAE460F76F90232 EEB23B80096E5FB0 12B93382F2B33726 A3B659CE06ADC82F 4F33CA27EA6AA9C0 B17C8638C2E6EAA2 0EADA6CE4CDB01D6 299E489DD5652DE2 C645488D5F39F2CB 02F788DFD5B43C4F E6BE91AC6D1633AC 3CEA239696A1ADA7 3C67FDDF4C33D58E 5019AC858C6C4A6D 9BB05F3E379B3015 F3292A2DB787290C 115D9E7A85629885 1A21C9D33DB25658 6635ADFE46D209F8 9F820576C4355AE2 D3A00DA7280711A8 6CF7FE534FF43C86 18E4F3DAD6404A33 03A12181D874EF73 EBC8019A4491B95C 1840204A29492650 F68F613FC2CFF2BA 327819F5537BFCE0 5F29969F9E3916EC 2F4BADC1F52200D7 D987FAF7F7D611E7 2B75631D9947945D F41F0806C916F924 06CD0750AA817663 09600EE45AE03959 6E4C6F182C6B75B1 DF24D9408248D4E9 C109CFEB57A6F272 FECC16B682305E35 934947744CCF3906 FBF3FA494D2F9C9C 0B5B479DC5D9CC0E 23A14D24BAD49AC9

Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208310655 (name+title). Key = MD5(password) = 089d932b55a9ddf0dc0118f99e96f345, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8cd78a8e-1f2c-572d-ab8c-283e11f41a2f
  2 dac620a9-1e0b-7757-879b-9de6c4d43147
  3 54ec675e-9749-5a8b-b204-253aff67a62f
  4 5940dcf0-0b10-8f12-a808-79e76b38f29f
  5 1caf60f8-5ed6-8c0c-bf24-b172cc667072
  6 c6c73d24-904d-767e-aefd-884d693b0a02
  7 03b05f93-64c6-6f7b-8806-ae8475f429b3
  8 32766527-ff17-3e82-801a-c2041fcd6229
  9 0cf2bbbb-20d3-8904-b918-557736228e07
 10 b7fb2e02-c2cc-5efc-a257-1b2f33eef460
 11 051230be-6ed1-79db-9732-8f1ef085ef56
 12 925f7290-75dd-3bf3-8930-ec1a32a96152
 13 ef03e742-d47e-192b-b863-19168c63c6d5
 14 2ee30dc6-dffc-6e48-bbf7-5babf7673263
 15 6807d240-8292-0874-b85a-91640f689c03
 16 325a764c-4704-6d5a-9bf8-69d0a86315db
 17 8068e253-9cae-787a-95a0-a523840db995
 18 4b641053-dbc4-4788-b097-1e7ac440a617
 19 bae1cebe-6cf5-3f95-bed9-cfaf3b1b7bc0
 20 d44b5db7-e851-8562-bd27-40051b4cac37
 21 0b6cfe1f-5b5e-392c-8964-d6fb6730bd90
 22 361e71e7-dc11-2747-871a-b7ee753a092b
 23 0a2ee243-9e41-71a6-ba5f-f333a6ca44b2
 24 92c0dd38-5958-89cb-bde2-0549e277cd0a
 25 e7a3bb4a-387f-3890-ab8d-7702ecfa1969

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5758876385731606743832783. Exactly this sequence comes out of new Random(283).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 2 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related