201209041900 zbuqm

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 203

Metadata

Post ID: zbuqm
Title: 201209041900 → 2012-09-04 19:00 on A858's clock
Posted (UTC): 2012-09-04 10:00:38
Timezone: UTC+9 · title 19:00 against posted 10:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209041900) = efda3f24a366e19e11ebd81e8b9b11e6 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(203).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 58 · predicted N = 8 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5EF1AE1460474C1E 8DE1A32B3656CE35 7B8E2AB02B54FBFB BA5D0263DE7FBB9D 627D81C2E445D7BE DEDC3FC35BC9F950 65D02485C2F8C557 411216CE6CB387AF 99E73E0D019B82A6 0A2CCD6810FF99A4 0631C4E9B1843B43 770954F48E026303 A6FB92AFDCC4D1CB 73BA9BE222AC539E 91EAE537D117B092 E48A679A991B15ED 30A0CC42153108C3 8C18A048145E2ADE F657D1CBBDFA4D1C 6609777EBD658100 0C739343FB2CA4AE 2B023665087EE907 1BB55F7AC0542B2A EC5F27BE68959AB5 074DCE7FD5C5DB37 FB47DD8A17E343B4 E7469D9002E8DA66 FC903844D7DFBA3A D2594E4A05ABFE95 635929C55ABFA166 CAED1392F08B429A 51B59C14C74828D3 206028927E4D3AC4

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209041900 (name+title). Key = MD5(password) = efda3f24a366e19e11ebd81e8b9b11e6, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b96483c5-ef2d-7bf2-af9f-757f85c7d5d5
  2 21585515-7584-3352-bb96-c28af40a4aeb
  3 20c8c734-6a47-5657-b9ba-5ded468704d8
  4 bd4f8ec2-fbf6-77ad-be24-b7b6888ffea1
  5 d939878e-bb44-7a6d-bef1-0793a181be33
  6 e0fc4e68-f986-8c74-8bbc-a85c31d134c0
  7 de652fbe-1c30-79bc-b6c2-af4feeb1b0cc
  8 09a0f73f-3fd2-25ae-b9e9-40de60afba7c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 73577872. Exactly this sequence comes out of new Random(203).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 58 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related