201209041130 zbcd5

explained decrypted filler

seed 561

Metadata

Post ID: zbcd5
Title: 201209041130 → 2012-09-04 11:30 on A858's clock
Posted (UTC): 2012-09-04 02:30:17
Timezone: UTC+9 · title 11:30 against posted 02:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209041130) = 6867b39c24872e42a258508b59379eeb (name+title)
GUIDs: 8
Filler GUID seed: new Random(561).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 43 · predicted N = 8 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DE0A8468700541BB CFD1FD0240BCE744 C12B24B9A0D81A26 227BE60A6C853CC3 51D1030D0EE6774E 188C46E9961C544C A61373CF8E0BFCF4 398FACC034CA95B0 D331BECD4809063B 5F804A0FE9D16C02 8BA3648CA1401467 95AE0B012DA630AC 6A6F23938886CE90 E2D0118EB566AF5C 6DD9440603ED9825 BF27070FD14C3DD5 FE620A13D68D1A7D 1F421F5C4AA34711 32985BF97EB5047D 7B65FF467BBDDC52 30E285F1F50D918A 4D2FC46E8080E4C9 EFBAA7E0F3E56622 516A54E8631AFED8 18AC211E65FDFCE5 6A5EC30121609916 100A9DE76BD16FE8 301C755209FAC8B2 B7DD46E226B33541 1883FB5AA34F6B34 03C6AB79FF24DB64 67714F9C51E88AF4 9BB1ECB6530782CE

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209041130 (name+title). Key = MD5(password) = 6867b39c24872e42a258508b59379eeb, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 28d6e288-6165-77ed-9422-2bdb92f378f3
  2 f35f5a53-dbf8-3899-be49-a8ede546e1b6
  3 699fe552-be50-841d-b703-0cf285f417c2
  4 ed8995da-ef55-2b1d-aa02-8ad806cc929f
  5 c1fca613-42f1-4ac8-8da9-c2c97eeac60e
  6 7d0a3214-c0fc-700c-9efc-000a9bfdd140
  7 cd727919-94e9-29df-9f43-d1869be423a1
  8 f168ae0f-2c91-7c93-878f-1b56376a3aa3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 73824727. Exactly this sequence comes out of new Random(561).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 43 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related