201209041300 zbhoy

explained decrypted filler

seed 581

Metadata

Post ID: zbhoy
Title: 201209041300 → 2012-09-04 13:00 on A858's clock
Posted (UTC): 2012-09-04 04:00:23
Timezone: UTC+9 · title 13:00 against posted 04:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209041300) = ef9cd8cf55ab88afbcb29e72cf6105cf (name+title)
GUIDs: 22
Filler GUID seed: new Random(581).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 46 · predicted N = 22 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D2278D66896CBE42 8585BFB07BDA19E0 4B4B03B16ED384C4 4ABC36A597DBE4A0 2D0B7BBA82C90C25 66BDE605FB637B59 496792AA43973D6C 29F3667EE2A23D5F B204908E38C81DB2 BEE310522519D730 CC723ADB4D2825A6 02EC0545D4D9B5EA 3CE1104EF7761E07 79F11E290A3C2B0A C8E41FE34675E37A DB3FB2A31350DBAB 7458A932781085F5 A1898B9D2BA09D00 A83EE6FE695C03BA 1A72D5DC2FF64E2D 4CF3D1E87558ABDE FB825C23D841F90A 436F9A2ED99BFA84 A5A9B72B7DCB7993 03D2C622ECF280BF 07BF5D8D29F9015A 84CBCF599656612F 62B9B99FD92B19B0 CC21B760067D0B86 7CC97D47BB07D435 DD672E99E7D052AF 32C268D539BF1FD1 E7EDF5942D5DB35E 0CE2F70D7FBC6188 DE4D56FE81152B38 3DAE1C7C8D81D68A 77299BF6C9F707B3 1EB1E7DB81971026 352BA5EE716FBF15 288FA73FE3EC5ABA B57E3404F81EE6E5 98E014D134AFE715 788351ECB6608EB6 D48551F7586AE858 4584601E3296C616 E53376C258ACBAFD 965203B9BC8D7701 309491E9C6EC553E 07CA32AA6A1D8DA6 1CCD55B217007E57 37A78AA94A712A20 B3E7B70F56A331FD D5B5FA979A7BB437 5E8EFE352CF1EC91 B2199DBBE0C79F97 905C7834D186D92A 2FFE914F6E5A6120 2F8D9C8A71195542 C769E7FDBE368621 BC5156E9D6C899F9 FF103DA23AACAA2C 419D6B22380F7FEF 2F840777954074C5 5556E9BE8F8627EE 0D2941B1F7D9EC7C D823864703F5F09B 3416E84799DB14BB D9586D7627EF676E 5125F9FD2F3B13FA 5FB2971EA5D6F2EB B7D2D1F4E7CEC9C7 7F1E6A2799A2815C DC89EB682D5AC2F7 C64DD6AE01BD02F4 C800B62E20E8FCED 44AD489DAAB4D370 5F944604A74CB535 8F917CF9A569C1B9 1BC431A9F20918B0 2206BCFA72C41EBF DB42E19E6C403A60 87720656AFE24E0F 38564F50370900F0 F10BA93C9EE3473E 18F8174C26C8C06E 75405E21F3ED02FC 0414121A4B3F7186 07C1D9716DF9CBD9 AB9B169FDDD7EB4F

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209041300 (name+title). Key = MD5(password) = ef9cd8cf55ab88afbcb29e72cf6105cf, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d3e41001-bc49-2c59-bd47-04eef8487d8b
  2 c177563e-c978-2fa2-8846-52fc91de264a
  3 3ac76f4d-5fa1-7ea5-81a7-aa6ac419b229
  4 7271eb94-bb87-5088-b8cb-6f344ee500c6
  5 c3b13823-d9c2-4484-a261-b1d5323f94ac
  6 eba22ab3-b675-2370-829d-a925b1ffd76c
  7 867f7e60-204b-2ef3-af30-07f8997ed6b0
  8 bc5516bf-5a9d-8f51-88b6-ab72e2477058
  9 4263f6b3-79b4-7039-8402-938e6c6dd399
 10 b35708f6-8b13-468d-bbcb-417c2d8b065d
 11 f512ee94-b6b9-2772-9b51-cac3ea01ee45
 12 cfd6baa0-df9a-07d5-8da2-484b6b324916
 13 e42133ef-2f47-0628-8007-7c7416d18526
 14 61a78c4a-83ec-6375-b0a3-d675f92ff2ab
 15 cad4a508-53a1-57db-ba08-ba28ea99e9f9
 16 04a0ba3a-f540-7a76-a903-a15a40f9841f
 17 5258624b-8b69-0c71-841d-8ce466af8eda
 18 0a450a6d-293a-1a93-85fa-5ea8dd0e9d63
 19 c0927f67-d10a-32e9-a85c-42c7a0f46a21
 20 1639b239-0482-2410-ba0c-9a539de9dae8
 21 fa159600-256b-0072-a87c-1a652967d781
 22 a9336936-6b1d-3203-92c1-6aa5451a1949

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2275422874200657013203. Exactly this sequence comes out of new Random(581).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 46 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related