201208310406 z4jtn

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 693

Metadata

Post ID: z4jtn
Title: 201208310406 → 2012-08-31 04:06 on A858's clock
Posted (UTC): 2012-08-31 08:06:15
Timezone: UTC−4 · title 04:06 against posted 08:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208310406) = 7331db9af2474de076a70df827750a31 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(693).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 18 · predicted N = 18 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 16 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

04E61393611BB939 FE748537F66CDBF1 796F0C7CFF995022 DCA4F3DA6D628120 668C998514922842 9B0A9E633A941555 0D40ED0B59E618CD 2A353827E53CFC43 B6D0B9F2F3CED53D 5C81E413D25086EE 28973D1E70EA6520 3E39F3CB6A0910B6 A724D90A8A151B50 F0FDD40BD1476B5C ED4C41ACFC8557A0 970DD7B2E69B8067 191D45D5501A63E9 EC4F7D751DEBC480 E9AD920C845FD9C3 BA6C48DC19F67D96 14E20316A044177A 44B9DF50CDC629A6 2CBEC5D91978D897 E50D46FD67BAF9E5 53C36D2F6DE5C24C DFCA658C9A7B6603 562A55E27FF5776B A6D190A659D3048D 9B3695EB81956EE3 1A238627CF357247 72C64E912AAC86A4 86587DDE14105EE4 FBCA48ED61D9793B 3D514A7AEDB6A1ED EB17194D4F1F42C2 11F86C4C8605CFA7 A48429246E047137 F2D4C27CAEFC8893 FF152036F96BE74E 6E65400AAE8F9792 23A44A28AEAC749B DB3AC5BCFADD4B0D 6652C9EDE99F7D43 408CE74D6CF1B430 FE88D0A3C95A39D7 E8C5FF13E9718543 52681935A37662BF 2DAED263C12EA51D 5A89336DE1680CAF 13B442EC84CB2236 99F2B4567F92EEEA 754E8E78ACB672DC ECCBE2C3AB2A2FD4 F7BEB9FC629B1E1A CE865F011C45417B 30E6A6CD5F3C9937 319D21929B979F88 E8A4FBD5752D908E 578F5B73514F4914 129609E381603960 CBFDBA1E5DB0FC58 2EA3B3BAD010B3DE D0F4B6DAFE949851 0535C154698826F1 7F35971F6CAFEF74 F06EA691C4A1BCB1 AD4318CC2921D956 D9BFF06308CA69B4 60635C21D48D6C1B E5B1B904C06CE34F B543CF094D945FCD B0AFE06B3EAB4925 46821A34ECB58A34

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208310406 (name+title). Key = MD5(password) = 7331db9af2474de076a70df827750a31, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1c8ea39d-df3c-64b1-b7af-1b984e847f56
  2 6ee4bdfb-771b-1a28-8261-8c1b7db37944
  3 98504a1a-07aa-115b-9b04-19c0c4aaf856
  4 46db73b5-25fe-4544-ad01-865edbc62742
  5 7554783d-9ff0-0929-8808-6158dfd3d4cd
  6 95691cc5-d0e3-1feb-9863-621bcb1dc316
  7 0eeaa2e7-ef1f-331f-8777-cf7a5700ebc5
  8 49b341b7-d8df-095f-bacc-10a8333bf40d
  9 6a960631-e4f1-684a-bc22-ee13f0e54c81
 10 8f26b077-d699-7678-b90a-571857e4dbba
 11 83e78391-629d-7ef7-bde5-bccfd80a60d9
 12 2f0fdbd4-65c9-46f8-a131-70a49a9b4a8e
 13 f99f7b5f-16af-07bb-a2c9-695e5f20d960
 14 7caff5c3-187d-0dcf-b98e-2c53991a46e9
 15 73ce6dc3-d5e3-000c-b38a-8dd3f1c634de
 16 dd001afa-bcd7-7fc0-9966-3357315c5502
 17 9ce4b6a3-7e19-17cf-ba64-a2873384ad30
 18 e797f5aa-b32a-56a2-918a-2f8858f5ad7a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 611401306774000715. Exactly this sequence comes out of new Random(693).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 18 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related