201209051029 zdac5

explained decrypted filler

3DES(name+title) ECB, 23 GUIDs, seed 989

Metadata

Post ID: zdac5
Title: 201209051029 → 2012-09-05 10:29 on A858's clock
Posted (UTC): 2012-09-05 01:30:01
Timezone: UTC+9 · title 10:29 against posted 01:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209051029) = f1df04f9dc939fcdf626bed96322f797 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(989).Next(9) ✓ verified
Run: Run 28 (seed 1,774,293,828) (seed)
Draw: 0 · predicted N = 23 ✓
Machine boot: 2012-08-15 12:08–12:38 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

65487EE2BF404AD2 444920E64E9E650D A53D0C293C2B970C 085F9BA659121C72 7BAEB9ED0DF11470 8DBEBF01913FE05D A8AC3FF5B94279E2 23F50135D52E64B0 ADBF8195952FAF04 B1781C4CD09902A4 0A6A8345CE177C84 57D12617758196AC 27F3A8AB26899D22 C5AF0EE2E8EE7C56 332B7FDF15F1E30F DDA2310BED69B4C3 D9D434F5F2069A6F 35108E30FBFCF3F7 90CE6D7722C19A8E 2C23A1BEA53D5ED8 DCB6FF9FA67AC454 4B1B97D5157154EA 9F06D3C1DFEDFFF4 93E8D86135444C13 EC8B79F8DBE8A980 F8AF621BCC5B7F70 79C27C5F99168BC5 699E280611F614E5 C2DEA40C908AED49 320799ACD06D83A9 DBC850F0E0C3C3F9 F9125EAB3D0730AE 446C66D02C111A68 593F452946256DD9 ED7AAEFA4680E28E 3B87240823E30458 596553AA7645FB8D CE506DC51C77EBEC 4D62CDA7587B52A7 056B81A56DCE15DE E276C08B24D57F36 C7E11DEF7C7A9EF2 6AD2F65C7F543821 F3B1C8A26EB44222 06385B6AF487494C 15129BABF6BF227B E641938EE9ED952C 6A5AFED1D121C71C 70417EA06CFB5A77 CB4BA15FD2C63DDA C22F8B967DCB95A5 9259E4D41A20F5CA 0309BE749055BFF1 AD45CDEA29D82AE4 87A1C1D18DC37295 5CEA42EF0296CEC4 47289C8735ED133D 00520F70701AC19E EFA136A0C2F1D4BB 92154E156007C3C3 972A767786247773 5281F36C66262AAD 59797381C76D263D 61194EDF46F2DD84 D6931543E8BDA51C 48A3AF1447C6592F 23D180EBDF901DCB 2347A17D83F2B1CC CC1BFDC79D460864 B0F0D92E737D6E9C 2F61AB833D8E9CA9 D7E680EA2DC24FF4 E857C6E92CF5D767 2017F8EB4824FD9C 983309EB05E5CACE 4B7FE6CCBB529AEF 8E7DF92230B95C02 B9EA468BDAE14EF8 79B4028F566F3EF0 F59738D0852AFE61 D729A5435472EC8B 6E7747FD5E444DDB C580700DD3C334F8 56A3626445CCA345 72938F6472444FA9 3D54D1A3AF0620D6 DE071F42A0013998 02944231B305D6F7 05685F1716BF59F3 286794F8788C1F88 BB52089F706A0AB5 27BF0F41F8A479DD 92A1E463229611CD

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209051029 (name+title). Key = MD5(password) = f1df04f9dc939fcdf626bed96322f797, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9eccfcc8-76e9-30ed-87c7-0475c08f3c50
  2 86e11f27-d64b-0f06-b381-6a1b80c50420
  3 736d16db-6a3f-06f9-ae5d-538c8efca63a
  4 ce6d2114-a728-55ac-848c-876ccf358781
  5 5bf740ff-658d-60b1-94c4-9ff0a2505a7a
  6 330feeca-1af3-7938-9bf5-ac794c18edec
  7 1541bea4-0138-0140-968e-06249ae81125
  8 28f5a14a-d0ce-5dd0-a493-8878ec3af2a6
  9 5bbf9a8e-79f7-3042-9f56-ccc14f049dc5
 10 8f4c9d56-f2fa-8550-8b6c-85a123020a20
 11 b5c9fa06-2da5-87c7-a565-d9ac0aa0a36e
 12 92c151cc-f69a-5757-ad28-3c4420efa34e
 13 6967d7fb-7a2c-4b8c-ba3e-3d6549432063
 14 3533aa1a-0a20-0ae0-9048-1386215cf498
 15 4dfc8ba2-8b26-2d0e-bf46-46b4bea3eb76
 16 4dcc93af-cb5d-635d-b5aa-583a46251f34
 17 ff78946a-6bc7-5219-88aa-c8ef55ac9c35
 18 9907ad77-da8c-1ad5-bd24-edf7d070a463
 19 0d4a278e-c1f2-49d4-8b43-8b662c10aa16
 20 9b49a73e-97e0-280a-8d34-e80afd96a014
 21 82f6323a-d9be-21bb-8153-97ddfab6803d
 22 56a382ff-d198-4984-a94c-bd2f23e7c395
 23 f342e8dc-1694-1d59-8de2-00cdffd3ba24

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 30056705388540265142241. Exactly this sequence comes out of new Random(989).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 28 (seed 1,774,293,828): new Random(1774293828), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 12:08–12:38).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related