201208310207 z4fun

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 105

Metadata

Post ID: z4fun
Title: 201208310207 → 2012-08-31 02:07 on A858's clock
Posted (UTC): 2012-08-31 06:07:07
Timezone: UTC−4 · title 02:07 against posted 06:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208310207) = b96be0254cdbaa2fbc8a5080fb8686c8 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(105).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 11 · predicted N = 21 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

620F760FA50F10D0 8AD5D7079953EAB6 08F0060DDFC13F75 A86437A1020249BC 5BFBE1878818EFE6 8F150A437BD909C1 36AD731EA4304313 3644D6D19587891E 4FD8B6837EA81D09 06B3DE8604336810 93C2984BCFA224FD 9336A9458E95935F F0D3C4A7B6B974F9 BC8F9A03B1E253A0 BE325A418CA9CF12 6B54547232712309 93B8A9F42784AC97 14BB90937943FEC4 79FCC282C4E780E2 D32B33F41D12AB72 2D49EB2E56191653 EAA537C8EE6E4D01 BF145DB865E6C73F 4090A2B3B8407EE3 AC74270487C9CA1E B51F67E4E609B437 5CA8522A92B7857F 7FAB0E0BA1C161C6 C4593FE73778ABE0 5C8EA75E002AD3DA 174E769AD3B891D5 F60F0755AE8A0E66 71AFAF386CE8D5C3 CB4B4CAA657F1688 5DA87E64B13E9D81 5095CC3829F7BD8D A92DFD2F0383FA92 7E291B24A0E31E9C 5F6564049E28383B 796902EAA57B36D1 F2A92585F8E79C73 3FE0CDA61CB567FE FD40A4A9655D99F9 C7D36444034088BC E510DAF0280E1D75 86D88C11979DAF45 33404DA2BB5A0AEC D3FD99BDD9CE6F61 F1BC6861122800B5 BBFEEC3AB78CC995 48C51E2AC071B776 EFBC4CCDF42E15C8 39279B84B500ED4B B8D62C6578DC7B93 8FD0EB2874827E1E 3DE9A6B74EBEEC27 6DC3F0FD8839B3EF 3278AF13B75050FD E068A2E2537A0CC5 C841FA3433B1149A 308621FFA2B216EE F8EEE7A316DB80C0 B2899BB907FEF537 71671B1C472007F1 76E6D1E697318047 618874ADBEEF59B1 A778F579665B056D C659F2CB36DF8235 8CE3D720830111DD FFBDCF3CCFDCFF4D 9B32C678DE3271AE 22955496D340B20F A59D3908664CBF3A D2CD8AA563E9F4E2 EA5E37F4499D499A B15BB31AB8684036 73A6DCA8F3833BCF B78B8C4FD31D4B7D 452EE77C54083B9C F9BAD50AEB5D5598 0901B5999D7FBA9A B0D84E6A18023E36 D5E1755C6DF68C43 27911B223C401DA8 400236CFA8951889

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208310207 (name+title). Key = MD5(password) = b96be0254cdbaa2fbc8a5080fb8686c8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 55d5d6c6-4622-5a91-adfe-ee8abf7f1cb7
  2 4fe3800f-6e63-5b4a-b342-cf8e68a5ca15
  3 6156051f-1cd3-13b2-8594-fdc9d43f732a
  4 4125814d-bf14-8ec0-ac72-02001c7d95f4
  5 f36e054a-1bc4-5cb9-a6d8-2ad93dbc2e9b
  6 ccdb0924-904d-23eb-bd11-a73afacc0b57
  7 619d61c1-24a9-8269-ab8c-ae031773f9f5
  8 a8b81e33-673d-1a69-b48a-1b1325dc98de
  9 40d0bd83-690a-8bcc-9cb5-84287ec17728
 10 9b6d31d2-b6c8-86b0-9c4e-de43665cbd7a
 11 0cb0864b-c2a4-50b1-84a1-0c9dda25c8f5
 12 e7b74499-7ff7-3d9c-a360-9717d67a7fec
 13 024f2564-53ea-797d-a300-5fd9909370a5
 14 fcb78c5a-a62a-0775-a23a-c181f6b4a452
 15 dbb741b9-f313-41d4-b9d7-49e6dc229280
 16 e57af0d7-917b-5e07-a0f0-79d1bd399c9f
 17 1c3a9738-2cbf-0af0-8af0-a15622c86009
 18 cda340ca-e6bb-041e-bee9-3ef62774ed75
 19 3d4c7f8d-88aa-4e04-b9f5-c693bb8e81b0
 20 1c628c30-0c9e-85a5-9e3a-8f2144b8727f
 21 39a7e144-726e-61ab-a264-6a41ba31142b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 551852818853704500486. Exactly this sequence comes out of new Random(105).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 11 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related