201209041600 zbpvq

explained decrypted filler

seed 903

Metadata

Post ID: zbpvq
Title: 201209041600 → 2012-09-04 16:00 on A858's clock
Posted (UTC): 2012-09-04 07:00:29
Timezone: UTC+9 · title 16:00 against posted 07:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209041600) = a4d970c3e9ceec7d091fbde6da76fc4b (name+title)
GUIDs: 12
Filler GUID seed: new Random(903).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 52 · predicted N = 12 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C966EDF347CA12D8 0FD9F04E9DB1BDFC 0F1EE19C9ADC94F2 A4D3147246287C5C 964F1C02894F2A6B 747BBE2A8D9194CB 5ECDCD7C15A1F709 71148FB1AA9D6149 F0836CB7FB857C71 579FC8F7C813840F 2AAB3BD862026DE3 8C11603222BA3461 934F85978326F5F2 16EEFA73F9D65EB8 A3A479AC161C74E8 94967837BAEA5CCE 877509235F636111 56408998794937E3 529759D0298932D2 0F8F76108AC79C0C 1B433AD1BE49590D C58A01646EE6D693 4898F6CB570ADC5B 7231F264304C8D5C 497CAC89E80E2558 6A71363D3052E025 035110C6DBB591A8 192DD27687BAF85B 0ECF629D04217D8D B0830DD240FC61D7 1D5BFA9D1365FDA0 C000FA22A6013F96 03B981A7E197302B B286FA3EB59AEAC9 EB0544EB35FDC0AC 49110600F0320D4B D83CB5AC6891D778 1BC952CB8878D645 B869A4C43D779F68 58E2FE4C692531DC CC1308BBFEBDF9BC B8F9E3949911ABEA 6A45AF91ACADF02D D3B205C7419B2CC4 C287B4D2C09B23AA 15DC71D3ECD78362 0C2134B1DB5402F8 4D04C5313EA15CA1 D52A82A9686FEC74

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209041600 (name+title). Key = MD5(password) = a4d970c3e9ceec7d091fbde6da76fc4b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d9df30a9-d2a0-415e-95e9-e58499cd6609
  2 cb2fba2b-070d-64af-8a97-4ab129eafb32
  3 5b0dda6f-77e6-84ea-9ee1-4b1685a315a4
  4 ac690c02-9033-2525-a675-fbb20d31e8ea
  5 47053c19-e7b9-8313-9256-52115d6b7e42
  6 1b282099-f0bf-661e-a24d-68dba9fd2334
  7 1b5ee130-c10f-4521-950b-73926e99db30
  8 dc77d3dd-4b77-4dce-ab84-03beb11085ef
  9 2a26ff90-ee9a-6701-a4f4-3bc7370d2de3
 10 34000488-bd59-26f5-9900-38cce35570d8
 11 1520fbbc-bb37-5127-9812-eaf530472724
 12 42916fe5-e2c2-4a77-bf39-b7765f0e061e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 468286446254. Exactly this sequence comes out of new Random(903).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 52 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related