201209051100 zdcd6

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 231

Metadata

Post ID: zdcd6
Title: 201209051100 → 2012-09-05 11:00 on A858's clock
Posted (UTC): 2012-09-05 02:00:02
Timezone: UTC+9 · title 11:00 against posted 02:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209051100) = 903037c4cec4cc529339adbcc8d9a5eb (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(231).Next(9) ✓ verified
Run: Run 28 (seed 1,774,293,828) (seed)
Draw: 1 · predicted N = 9 ✓
Machine boot: 2012-08-15 12:08–12:38 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

93A7FCE432C78E47 B82E81E08384BEAC 6EB0A0338B889752 F52F45980C7C56CC 7D7D67006B5275F8 F5EB36EDD01D6592 7E982034051B486A BC90BE712AE712FD E78C26E2EE5E256D C6CB80CF29DF101A 37C403148F4837D8 E8297D7396DD8BF5 868C0E68E3953599 B6386CE7BAF1A8F9 F4375D31DE8ED48A 6D382DE41E71D500 4ABCC6265DC9D5D8 6AB03F591990869C 3833C91502C273BC 6710E4AAB289F9F5 A71317E840225F13 1B1BCD273821A9C0 7995EF5675752C6A 9CF1D24C4395B936 206949F8CCD78EAD 49CD502E06A9FFFC CBE6BF8C704AC33A 06E8E28AFD79C05E D5F23DEF91853CF0 B359FA85C339FE51 C33E0D3042A2E460 39D5C3EEF9CB2968 73D134073FC73899 21B14C4EC16F4C89 0892587036C78873 9C9F9BC58A3009B7 7EB6448417506E0C

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209051100 (name+title). Key = MD5(password) = 903037c4cec4cc529339adbcc8d9a5eb, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dc690193-0d15-30e8-b747-bb35d038f8ac
  2 006887ea-a5b9-5bbf-886f-887d9e24c030
  3 0b0addfe-e7bb-2fd7-be31-14f0e84b8140
  4 dc1d6404-2107-7429-b966-8971aa42a3f7
  5 e4569cb1-55c0-492f-b2a0-bd8ae58e9914
  6 f8451605-0060-329b-9cdb-399e85866d54
  7 54b3ab63-70a3-3d03-827b-f541594cbf79
  8 376fdb49-5e4d-275c-bdee-0fc7376eb4c1
  9 7b36e8ca-348f-5fc9-aee3-9f17434b8cf7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 352743325. Exactly this sequence comes out of new Random(231).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 1 of Run 28 (seed 1,774,293,828): new Random(1774293828), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 12:08–12:38).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related