201209031837 zay2c

explained decrypted filler

seed 362

Metadata

Post ID: zay2c
Title: 201209031837 → 2012-09-03 18:37 on A858's clock
Posted (UTC): 2012-09-03 22:37:07
Timezone: UTC−4 · title 18:37 against posted 22:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209031837) = 07c2a9422fb48e993e0c8d4fa3c4659e (name+title)
GUIDs: 11
Filler GUID seed: new Random(362).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 37 · predicted N = 11 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 12 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F0FA0C4B7646C845 89EF354E93D14E46 8DB7CEAF9F17E0F7 E3204D7190DF0916 E62C058C2524A539 B270854956239F57 66965A24F31E8DCB BC3EE257EC9D69D4 432CC7FBEFE45095 521359F561DCE7EC 99F3C41D3B36088E C615B9179AC236A5 E3EB222C8F6C938B B209C7C430026839 5EC616155E3CDDF1 122ED6EFB0BCA15E 28EB6196616BDEBB B707EE6027554027 C0E9BE2261FF323A 4326253B6303577B 44B886D44633E5BB 51BA3043587FFF0E 035B61F1EA01ABB0 AB95CA45CA4D2FC7 CED8E5C0D53C154C 3F8705BDBE002D80 52F191AEA0FC3B85 E6BBD3DB7580881D 5B0A6165D9382D1F 44AA04EBBDB393C3 3A24A645D6E0A737 D8DDB001731F5772 F40712D092158716 AA6F15ADC2796259 DC844358AD9451CA 5824C12007FC90AF 7423152BDB1D4307 B8A36123C274ABA4 D688BFAB0622170C 7FAED5EC1B61A20D A67FEC632F353CF2 4A8E90A98D433761 A1EBCC809D9507D4 94D67AB8C8F1C74C E4B6980A31598DDA

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209031837 (name+title). Key = MD5(password) = 07c2a9422fb48e993e0c8d4fa3c4659e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 59b3dec3-de01-704e-8ded-3eb286882f81
  2 34c320b9-52f0-0778-bd90-cacceb23cac1
  3 c7cfa071-c8a3-77fe-9dc5-c8d51dd58f14
  4 ccf69075-6f59-7680-8e0a-c21f3bba635c
  5 4cbf320d-5320-51ac-98ab-d83476eccf3d
  6 cbf77a10-6645-8306-bc9a-581b1beb4be6
  7 36fc6d83-a245-0355-9123-8a4639a5e835
  8 f092f6fd-757f-0bbd-9ffb-27813c10c5b7
  9 bcf12948-3992-6055-8727-67c709d45cbe
 10 dfa365d1-78bb-67cd-abd8-7143c86977f9
 11 3c1e8e88-c8e0-8264-9057-0cd6aa2d318b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70775800668. Exactly this sequence comes out of new Random(362).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 37 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related