201209042200 zc0ic

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 581

Metadata

Post ID: zc0ic
Title: 201209042200 → 2012-09-04 22:00 on A858's clock
Posted (UTC): 2012-09-04 13:00:49
Timezone: UTC+9 · title 22:00 against posted 13:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209042200) = 9a5be4ea6ab06c1740264c0170e38fee (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(581).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 64 · predicted N = 21 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

36A09D0F2697AC23 3CBC16B2155A812F 97F8308390DD1355 BE9ABAA7AFAB3961 CC0421F47932080A EBEB99BF1BDEB0B7 E8387BB27A21F9C8 62A659429FC4B573 B042472045A82220 5EE8617B31FF81A9 C3D358F83BA27391 69C39E9E29B4DC1E 617B1600D406343A 87AF62AC118E6BEA C65A7278BF2F3186 C87A35B8ED7677D2 60718E5BA1935AA9 16F0E54898480957 92BF139E6264B97D 7FFCB665C256D723 6A00BECB56DCDF42 705B712243FF5FC6 62764A9F8A93E923 11A4CECDEFE6807C 9B6BB477B1EDDD67 AE163C383C680BD2 046A18B94514BCEA CCC8587F0050B3E3 9A2D72EDD3DA926F 90EFEEA29DE969B9 C2BCAEB958A46B53 8C5B6F41E384E32B 062BEB44CBE069F0 BB8D84BD6A0561E1 7B21AC8C15385096 476FBB4EC2DDBD94 15C7A39B93B56CA7 9701CFF805E73093 F1A830E0B29A0233 2195D51A68D08623 37D394DCF8E551BB 67C11FFC18208F22 EBEC18B8FE6BFBCA DD0F28C007E76F51 19C06302961ED472 6319FA56ACD19E4D 9333A3ADCDF984CA D3A1160A15E70D30 6A76A447F2572A47 037D03E83CC8F54B 64398A2D66974E55 E968E6E7E1039D18 0F510B010769E0E3 CBFF47A42ABD9675 BED1C43A06D92713 8057A31CC33C4F6F 9D9F9012307E23CA 446F5B3B77C00DD2 BA70C8A4EC8E6EA2 9BD25D80F33ED286 32AFB3D9C3E12EDD D2C5A1AB3A0CDACA 3842754BDD2BCE8A 84CF2CA00486FFF5 1684EAC034F9EA42 B8BA4C7E7D88603C C702F525F7B1D3B6 A4E95605E56C7267 060C3BA4C5F521C6 C4C0891ACCAB2B88 B24A96457EAB8564 ECD253F777C575D5 36A2F58CD967A84A 24DCF4B59440A5AE 3D353F3A51CDDBDC 77E23E485535A979 A7132AF1DB71A6CB 6727EEA8D0F48F61 B19B8E70152F4C75 F6981B735F790F25 B80757E8C52DBE81 E09F1E164E02757D DC7415E3ADE4D472 9674B5F378A454B5 94BA86790031FBD5

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209042200 (name+title). Key = MD5(password) = 9a5be4ea6ab06c1740264c0170e38fee, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 175f6ec5-de44-2885-8078-ec0b6860d313
  2 dc4cebbd-5e05-20c4-9b0e-e53b21ff12d2
  3 efcb8acc-6447-7f93-a54c-0bb76f7699fb
  4 d00ee5c2-aa9f-5a4f-a6ef-c9f2a8c0fef9
  5 7de224a1-33e5-4ffd-bdef-c1e1b0439211
  6 47be4213-7034-2810-8b53-800ab94e1843
  7 410e11b1-289a-2d35-b39b-e95a1c6b5a81
  8 6a3de607-2804-8d1c-aa56-380393a1f0a7
  9 06539d5a-0cab-7325-b9e8-605c2fd9c21f
 10 490c4997-84fe-4e93-8513-ad19f82e84bd
 11 ca2b5a21-804e-22e7-89f4-0b909f86a70f
 12 44dbee53-c594-0fb3-801a-eac18b069f3a
 13 fc857600-6abd-04e5-9bae-3fa219dbd82d
 14 7b8b2274-f1db-68f2-ac98-7cbef3580932
 15 50ff4592-64f1-5a66-8e68-345b3615c2d5
 16 18fc1db1-a309-79f0-ad16-a0de9502a46b
 17 985cd706-b33e-0ec3-b83b-278eda8b0321
 18 5a4fbe94-bdf8-1dd3-b54a-9e52794cc493
 19 0f2fee4c-fa08-3c0a-9645-618dd6909f98
 20 0c36658a-306e-234e-917c-23888e66fcf6
 21 28ede865-77c2-00f4-8c85-382a81fa6bd1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 227542287420065701320. Exactly this sequence comes out of new Random(581).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 64 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related