201209042230 zc1tf

explained decrypted filler

3DES(name+title) ECB, 16 GUIDs, seed 994

Metadata

Post ID: zc1tf
Title: 201209042230 → 2012-09-04 22:30 on A858's clock
Posted (UTC): 2012-09-04 13:30:51
Timezone: UTC+9 · title 22:30 against posted 13:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209042230) = 4f4678222ea9507a01ddd6a7972e2f56 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(994).Next(9) ✓ verified
Run: Run 27 (seed 1,337,299,625) (seed)
Draw: 65 · predicted N = 16 ✓
Machine boot: 2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7CE03CB9FF6B8F43 D86974A569E634BF 940428A5950CCCE9 DAB38C1A8E1F9F87 463EB4D5BFAFC8F4 DB1E3BC7328BA1A5 C45A0CC3F7DF186B E8EC453BF0F30E73 F12D752EFCA0946F 050C8A5A430B1C25 9A7260AD56F4B711 5F7DB70AF49EAAA0 26DAFA581799F6D8 E0F159EAF1A355A4 9951AC1DDB2F3F41 B0F6673E08D80889 98F23868F1AB8C4A 1808DA834D792187 BA086BC2A14D2273 B24ECBDD09708617 2D19E44492EB8CD2 6797C0CCCC9901F6 54E31A06754F5B09 8C09648D68B0CFDA C5F3C056013B45B3 488A756FE5A1661D 4812DF234A85CC55 E7A7A5A01525CD0A DED4A2A9C3157188 32EDE4B63F991507 F1A20EE5788E5B65 43543A90A9B8AB38 99D8D81119947200 D0BE654214910D6B 45D8D3041F15BBED EBA91B704FEF2709 AE1381D890EA65D7 D96282C3592AE026 8EAF590B13D9C945 B39780C1FA98DE83 FD35D4A7D085982D F2B6B5ECD6C608F3 F4CB56098870281C 45095B112F0E55E8 500F4964F7883082 09866B9700A3CDA1 A47DAA4F185750DE 87F2238CD08B1813 C963D898ACEC4940 42524B79E43CE165 82455F8D599C0C7D 8A91CA413AA7E8D2 0B04D487571C7167 8B861CB202C22DF2 BC43AA71E47F5E5E 742E782C9C42FAAC DD8A7604F14D2A1A FBBECF6AC286A84B B4E4CC2268F01FF7 549E5536570FC569 55402A976AB3004E E32275449AF8C2C7 8ED60F275B3EE84A BFF41410A31170AD D974BF54703634B8

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209042230 (name+title). Key = MD5(password) = 4f4678222ea9507a01ddd6a7972e2f56, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fcd7e3a0-d765-0406-8cf7-154a46536563
  2 ad88f198-789a-4a64-b5cf-04dc14d17754
  3 a5ccb836-ccb9-5b30-9582-c221b6ba9ca5
  4 e773b7c5-3598-683a-81c6-1c5b723b482f
  5 bcacae97-998d-8b0f-a36b-1fe6da52cfe8
  6 e66466b0-4156-1294-9c2f-65782369faec
  7 fdac0f00-f229-2f70-bd5b-ba14eadf0372
  8 fd8f2813-f679-100b-9145-fbcd1817f5e8
  9 4ea86d57-d5e5-80c1-a804-67696b4cb43f
 10 18630bbb-b8bb-7a8b-9823-670e9bf524c5
 11 552ac692-8394-57e0-a84a-4135584c7153
 12 f4da7e32-ee06-43b5-b931-2e4299b09f8f
 13 2ad44064-e25e-8206-83fe-c6ce2db19653
 14 4f57ea1c-582c-57d5-94de-dbf8bf6d8cf6
 15 6dd7a80c-3a15-6abc-80b6-622470161f38
 16 ed02559a-63fe-77a1-b463-b172ca41964b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0456812187548567. Exactly this sequence comes out of new Random(994).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 65 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related