201209031822 zax3n

explained decrypted filler

seed 139

Metadata

Post ID: zax3n
Title: 201209031822 → 2012-09-03 18:22 on A858's clock
Posted (UTC): 2012-09-03 22:22:02
Timezone: UTC−4 · title 18:22 against posted 22:22 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209031822) = 56be87601fca040104fc0f7022898656 (name+title)
GUIDs: 8
Filler GUID seed: new Random(139).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 34 · predicted N = 8 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 9 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

304EEA67A29EC228 2DC039C86546E5C9 EECCA7E1C61BDDB2 3FC9A572D8211E31 05D3F569942066B2 979DFA63A53F5AE0 3564F23A1B159666 FC7861A687B28324 7773163BF49C090C DCE5061E3B83C601 464A9426E5985E66 078BBD80F3C01BD2 F9622AF4303999B8 5EBDC0561910433D BD9293C5D37282E4 69CDF9AB90549890 5FCCC2E02C88F4C8 EA5A41275397FA49 373DDC898DC432CC E7C8F40C545137FB C72D053A7B46B0B6 AF19736508E622D4 3B030173C061CE3C F6DA46772F7CF6CC 788B5D7CEC1D04A3 5CCD305100DDC117 B80703716B04BEBE A281EEEE3C023138 326BA3EEB2E562A0 472A71EC4EC165DC 1051A3EB14EE8827 E08B816A738D1291 C81B5C9F33EE2787

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209031822 (name+title). Key = MD5(password) = 56be87601fca040104fc0f7022898656, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 09aaadf3-6f33-3921-b2a1-776745e34606
  2 7d49302e-5bff-5136-b6f9-7487906c7ffc
  3 04201d7b-6dd7-80b4-b723-01fa73bd38fd
  4 63c49de3-207f-2ac6-a0d0-6148700f2f0a
  5 02aff643-caa6-8544-aace-1fcd63240d17
  6 c854089f-ea5c-0d64-9e3a-d6dae77525cf
  7 1fd03315-375d-1f77-aeaa-e37aab14f7b0
  8 6cb861e9-5cac-1740-a285-a3830355fa2c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 35828011. Exactly this sequence comes out of new Random(139).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 34 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related