201209041200 zbe6t

explained decrypted filler

seed 585

Metadata

Post ID: zbe6t
Title: 201209041200 → 2012-09-04 12:00 on A858's clock
Posted (UTC): 2012-09-04 03:00:22
Timezone: UTC+9 · title 12:00 against posted 03:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209041200) = e6c155b66dd6fe5de2e777c56253213f (name+title)
GUIDs: 9
Filler GUID seed: new Random(585).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 44 · predicted N = 9 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

825FF4650CC51565 DA2CC1D0D8B13886 55BEFF86B7C758B6 C582537A1BD91C28 36A64E959598C180 CE32AC1CAE1ECC31 C440636342FDFB20 0BF383E4E7F6E159 C5C5DD1E2C05BD3C 7E0CD0E14A9836EB 7444E1C95BD17DDC 50CEB344E61C5185 07AB4934581A975C ADDBBA2810006AE3 967B1E9B8D87E695 419D59911A9804DF B405093CF9010CFA 5482E4569144FECA 738BC920BE0106F9 718EB9978E627F39 E6D57AA715E26ABE C5CB7E5BA6FA328B 1C5D5F8C4B79C80F 1BC4EFD8BFCF690F 9C5192DF86ACF7B4 F69C185E70434113 4753E920884FD1F5 8FFA936427CC4593 67B95FC7AAD9B244 E4A218835745B29F 1F11792BF3CE36E7 00457DBD47DCA0E2 5C5487FBEDA1A55D DE90E57D8AD577B4 3B4440ABE7FB210A 461A6AC48D057C73 FFF6B69929EC5908

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209041200 (name+title). Key = MD5(password) = e6c155b66dd6fe5de2e777c56253213f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5f314f39-1b62-3db6-a3de-b9e1e9232741
  2 d0c9a63e-def0-49a0-8181-155158ac7fb4
  3 a32a57ce-b60a-660a-b064-e541cd3fd84f
  4 155dff0b-e8f2-34ed-841b-db7ea8daa948
  5 d14bb3b7-2d8b-2688-9743-4355b14ecbde
  6 0a8c6d2a-918e-7c8d-b1e8-4e22608fd342
  7 d75a14f3-9ebb-0a9e-b116-80b6c8dd8f60
  8 3d235877-8d1e-8740-8b34-63d1448eef6a
  9 a1ec8156-9c97-31ae-a4e9-c2b200187635

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 346327083. Exactly this sequence comes out of new Random(585).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 44 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related