201209031827 zaxec

explained decrypted filler

seed 651

Metadata

Post ID: zaxec
Title: 201209031827 → 2012-09-03 18:27 on A858's clock
Posted (UTC): 2012-09-03 22:27:03
Timezone: UTC−4 · title 18:27 against posted 22:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209031827) = 3b36cd82d10355be63648af7ce06781b (name+title)
GUIDs: 16
Filler GUID seed: new Random(651).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 35 · predicted N = 16 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 15 · 6
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

98C145A1A8A450A1 6CA82CE65B248FA7 4C2E9C9BBA3359F6 949597A084CB8FF4 9AB2A1B52DB889F3 1574EA00065B88DA 7ACD16D0CA721997 AF3547D52DC671B9 2F9D598026BB22BC 02B46FFBFF29168D D3443F3816696567 C5DF9B1DC8FB3844 97B1FCDE59CFD5CC 60E9A53738D5C434 24F7E5C0D47AB7BE 36817857155EAAD5 323EFFCEDDF221E5 0F485927F709E5F3 39C4E0C8D6B6D3A9 57727EFBF85B6C77 9694917D8E7E9102 2AF5B4B1920C83C2 FF4B53BB2185F8DA 5548C74915F156E3 5509614A20F34B82 89F5B4DF09FCA19C A40A37DAFA64691C AA84B326359D74D1 C1592DA94F2599DC BEDA58A85B985FB8 02DCF211DFB3B903 754E1D95B25DD1B6 5D8FA17B39CB0B2B 0CA3F91091CC7154 713F2EAE552FE5BC E2A2F10F98E8CC68 99328011AA9F5C37 1D1C497B0DEA512E 4441D5FCFBA3A6D7 4440E9372CE978BB CD238BCFA4B64FDE 2C8EC7E18893BC17 5B8A67D49E714C2E 3E5CCAADB60A2E1A E8777AF989C884E2 BDBEB3F7C2D162A7 71AE2B5F8C95A5D5 1B9A8AD1BFBB022B 86274D99827578EC 83B48047BDEDB0DB E8916EED6490F6DD 3E4151A5A42D596B C828459D85467B18 7BC99EFCE872ED24 F1D789B688CD5221 7897F298DFF58820 5B23DA20D85D4B5A 556DC9A78839963A B01729587C2BDEF6 41FA12043C2EEAE4 23097D4FAAFEAD81 1143CD322E0B0389 C922E800ADEAA7AF C40E493A4637E304 27A65FC5A2D3FEF6

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209031827 (name+title). Key = MD5(password) = 3b36cd82d10355be63648af7ce06781b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 eef98344-2dcc-7e51-a663-2b62f29de0f9
  2 1fa67acf-e8de-74b9-9b7a-36f026387880
  3 382a2e5a-85d5-7bef-b9b4-999cd2e4988a
  4 4966edf3-9934-4d9e-9a1e-9add88e10575
  5 2d8e5d43-e187-14bd-8f90-c303b4966dea
  6 f3a468df-dfd3-4fe1-b433-1644da16ffbc
  7 12df8e14-464c-5191-ad74-fd95f03e1459
  8 905ab2a8-25df-0ccc-8847-066fdb7faee6
  9 a7f9850f-1fde-4f84-b90f-e8a6d7501706
 10 ca554c62-83aa-2cfa-b7d1-1dc0bdbc52f2
 11 432f66d5-f56d-8901-a39f-12c7ae8b1241
 12 c07ad8b3-5ee9-6673-9186-6655d903104e
 13 5cea3f8d-f91d-1532-9b10-bb140f4f4474
 14 e3572342-85f4-10b7-8ea4-aabfb1ae09d2
 15 2801c594-74f7-5dbf-901f-65a4c3c725cc
 16 34930ceb-e147-5265-ba76-616de4ea8286

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7774145042861155. Exactly this sequence comes out of new Random(651).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 35 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related