201209041800 zbt8a

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 245

Metadata

Post ID: zbt8a
Title: 201209041800 → 2012-09-04 18:00 on A858's clock
Posted (UTC): 2012-09-04 09:00:35
Timezone: UTC+9 · title 18:00 against posted 09:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209041800) = e9883569ece5e72792e12ebfbefe805c (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(245).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 56 · predicted N = 14 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 15 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AAEFDA6655C8F082 2AB8950510D19857 25A7969C623F55C9 1D51B88F14D3813F 6ACA544A1C297060 7AF7D08A4983F6EF B22E60BE91EEA405 CC36CE5C77657924 B15676CB71409155 1D465EFC78EBAFB6 4AABEB0A2FC5DBD4 B8AB3914D6849B41 0C2B2C575F27AA1D 7756374B7C15A4FD 89A04590D0787A07 FA59316E481A3D89 3C81028EB9997442 F092E75995F97C32 3554A60FA739710F EE3EC82135A4DB18 7532296AD1A37F9A AA0FA726296C8C49 19DD86966E17EA94 DD03C2023E324867 1BE1A03D19D1150A 4E55E22DFDE31027 9ED44D0E2C44B2C0 70B84768E82300BB C340828C93279C38 9B4E97EE001A6446 E1C05CF5FEA05BD1 A802E0A145D3B082 552F02A7B917F0BE C9C3DAF4C1CD2429 5A1BCB0909ED6B7C C28408A4F9751FF4 C386142CB14177FA 7D0B69C97BC63709 0D7D70141FB661A7 0C8B313C575112D0 5C81B2B18B2FD369 3108D5C8BD2C4F84 22EF3244B823EF51 D1936E4E0F226B18 71DE53F0F8078502 7B69B84E9E7E8128 050C551639848044 CC194C7A2C4753E4 76D1700409008380 71C05EF452A7D148 98826104709E704C ED368E52E9B4BD0B 1D740BD1E96593E5 F34D1E13B5D3B649 329A3C2E00D3A929 C930FAB9F5A71E06 AA9153FFC6683F3F

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209041800 (name+title). Key = MD5(password) = e9883569ece5e72792e12ebfbefe805c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 edab663e-0a70-6308-a12d-6e51b3085971
  2 6bcf1031-ad99-60ec-a0b7-566f0fbcfa6c
  3 6533dcbc-6af1-0a62-b7e9-32041e7657fa
  4 cb841501-3c1b-7273-bb09-12685206c42b
  5 147d233b-7c8c-727b-a672-17656ecd95b1
  6 0caaa221-d30a-5f0e-875f-3b5933517e27
  7 5a7f5892-f561-6a33-8f26-9a4346ab1d83
  8 4739eb2e-31f3-37ef-bc8c-908db82b0b26
  9 5d513a83-4191-2f8e-bdfb-7849fda0d256
 10 8b089797-476f-5469-9d0b-c82bf4a0cf40
 11 4a187bbf-a098-77ab-9ed0-af544412a6c2
 12 2e8524ea-7a4f-6855-aaf9-a55b455ff65f
 13 dadbdcec-d342-06f9-80c4-12bc4d8259e7
 14 34f01104-4336-8dee-b7f1-e83a70a0452c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 66077563257608. Exactly this sequence comes out of new Random(245).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 56 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related