201209041530 zbotg

explained decrypted filler

seed 993

Metadata

Post ID: zbotg
Title: 201209041530 → 2012-09-04 15:30 on A858's clock
Posted (UTC): 2012-09-04 06:30:28
Timezone: UTC+9 · title 15:30 against posted 06:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209041530) = 8c2dc8ee7f1ca882bb6419c2cbc43b0f (name+title)
GUIDs: 10
Filler GUID seed: new Random(993).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 51 · predicted N = 10 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AFFA87D38F883A07 CADD999C623CE76D DCCA2E6C36BA3537 B54F748F526F218E C9725B6F88E61370 A065B8FF8727F916 F5B3081E4731CB1D 4D7983F48188E386 B2F93307740C3736 B74BD5D4C6AFC788 5CB70EC8499B7344 4F18404BFF89B826 41597CFDB6AABA0A AF7444129CAA278F 41E822CCB845FB83 042DC4C5CF1C4568 A5588A2B8F8E5DB2 E7D393BDCC492D44 A62E870AE4D9FE88 5C01D18537F26F7C D4ED1B67DAF8ADB3 4AF8F575124AF2F2 3D50862686B80CA6 FFE4EE57F6C4A9E8 DA011D76209B5C55 8145031D73583BB1 CF639231377AD446 F2F598A4E4D11922 A6127C10B4386F79 941F4E9B83D2A676 47C9C671A24E2E0E C366E4A31A68694E 53BB063C23B0673F 264A2EDDCC28CD0A 9BD82C7FCD32002B D66BF582EE807170 41BD84B4AFE6EC1A CA1FA16F6457100E 29E8F06B270495A4 8133F5BE11ECFCCD F08030898D4CD022

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209041530 (name+title). Key = MD5(password) = 8c2dc8ee7f1ca882bb6419c2cbc43b0f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5f64c681-f214-4b01-b5a6-d265a0bbf473
  2 589da7e2-b57f-1c3b-96a7-011ce2f91f11
  3 606e614e-112a-7187-a6dc-4fa8bbfbb7c3
  4 7a07b374-4b10-45f5-a015-220dbc623c6d
  5 6b96ff62-77ee-4a6b-b8c4-b02d86696f23
  6 012a8f3a-52bc-38b9-8359-e5378221fc91
  7 53ab897c-35a1-786c-b5e4-dff7eaff7bfd
  8 237ff76b-9384-5bac-8cee-deea1b95fe61
  9 44eb1374-c2a8-7c59-8d22-d95aa2a14e92
 10 6c1a296a-da5a-32dc-bd00-4eb9370dfeb2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4174437573. Exactly this sequence comes out of new Random(993).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 51 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related