201208310150 z4f5c

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 656

Metadata

Post ID: z4f5c
Title: 201208310150 → 2012-08-31 01:50 on A858's clock
Posted (UTC): 2012-08-31 05:50:06
Timezone: UTC−4 · title 01:50 against posted 05:50 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208310150) = 1096f9c24113080f660694f066def00b (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(656).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 10 · predicted N = 9 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

36553EDBD01236A2 1454E5491C4E5266 7B1F989C81F6C991 4FBA045269615D56 D250F976AD15F51E E34363D22E7CB7EE AF485843D8890528 0E5876E86B5A55D1 69303B008EC1ADB5 9B14EBD7B84EFD72 B16914E8C80886C1 3C0D079CB46A5B05 B5697395ED1483E7 11D6616481A8D968 05386C84D2AA20FF 1F2A5E39C42E49C3 BABC8B61DE15C5CF AF552E8F5D6AE430 45CD5B3C65AD7A6B 5E6A41A9B9F81E58 596EA6A2BE02FF3A 0ED6AD7598B6B495 1FBA21E5F68C79F1 C3FA50AEC6603A55 7DBF7A22637ED794 13787B4F8C3FD6AF 339E5ECCCCFC610A 506CDF3F900AE332 0A1BE09DB57B70E9 E6D4304FAD554E2C 2BA7A6FC5A33754E 3CCFCC30B4F8415C 115A7D358D894B9A ACB04F139E3D8586 9F5C751C04098A05 B5581245D25F0AE2 99863EDFE9840BC5

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208310150 (name+title). Key = MD5(password) = 1096f9c24113080f660694f066def00b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 44d94923-ca2a-3131-90af-cc6401e649a2
  2 5842a93e-90fd-2482-951e-72047716c58a
  3 042e3a22-5d62-2dcb-924a-794f584f257b
  4 faa83c84-6f01-5ea4-9c7f-f6686f604ad2
  5 95f602df-f4bf-37ed-8e61-7b7fa6a6261e
  6 ec361f98-e499-7b6c-9a32-232461b19421
  7 f21f71b6-dc38-7630-99c5-5eea357442ce
  8 200cfbe2-b811-4292-93e7-97e0f6026fb4
  9 d2014f1b-1f5a-103e-ad25-c994d1ad430b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 322537741. Exactly this sequence comes out of new Random(656).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related