201209051130 zdee9

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 999

Metadata

Post ID: zdee9
Title: 201209051130 → 2012-09-05 11:30 on A858's clock
Posted (UTC): 2012-09-05 02:30:04
Timezone: UTC+9 · title 11:30 against posted 02:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209051130) = e4bb67e58f153f5860d9e3778b762554 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(999).Next(9) ✓ verified
Run: Run 28 (seed 1,774,293,828) (seed)
Draw: 2 · predicted N = 14 ✓
Machine boot: 2012-08-15 12:08–12:38 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7D72F7DF1CF439D8 5013AD24C5819B8E 2D0F73C401395D9C 94D90F57DA02EC32 155647B653AEC92A DF7364F7702983B1 BF059F517B304C9F E99DD5AF95FB5283 E1EA00ACA5C2318A 73E69B35BC9C2564 847470C3FC33A6E8 009B133E36BA4CE1 D545765997296C26 04F430D7E2AA13D9 2E9BA0637D71AFBA 61CFABB51566855E 9ED1B3A639ACC0A0 FB2F2CB8BE52BB20 82454F62E768688F B6AF3BF7CA0196C2 74DD0A5D400EEEED 7E7CA2B92BE81130 EB5C808127E7A19A EA43E8E9415C54E4 53DA358E1441EF71 4804C5B184574D5A 358181DA5E018A4D 026D957634B8F3D6 0F15FB42E3A4C34F 850E59B1EC329FFA BA2F5C5FD2FCC430 62CD3C5F587D651C 2B78AFD2B75A4C3F 4C4D9B3C73337ADB 4723B353506EA9DE 4FA823362BC6CD18 18E544C953F4F2D1 B8468BC4C1BF070A D2F474A5BBC9C363 BD7D5440DDD40851 73015658FD34E670 DD69045B9E987C4F 57113AD2C0809725 2718480344975E11 EE819F67E035D594 6843E53F9FF6F922 9327A2148B0C5F09 8533FBE0F0A20631 7D5EF4AD1B433526 70B47C742F1F2DEF B9473328EEA38911 2D6B31A3455AA103 321CB4A151376523 784873556C722261 E2782BA438D5A309 DD0D81501774A1BD 173C238778EFF8BC

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209051130 (name+title). Key = MD5(password) = e4bb67e58f153f5860d9e3778b762554, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b1ea43c0-e83e-5410-8de2-5a90e213e312
  2 f68b1527-1c9f-80c2-90ba-c55fba9a713b
  3 a911cc20-b88d-01bb-8ec9-e7d4eed2ced1
  4 62e7ecc6-99e8-7dbf-957e-bd28dc5e0d9d
  5 93de8802-e9b1-2a25-b0f2-54b367d496ab
  6 b1654d57-d112-5bfa-91be-62220273325b
  7 03f0d4e2-83f9-4bec-9b98-aaea5cee403b
  8 b662cc27-e79c-58b4-aad7-e8b0c2fe4eb6
  9 bfd936ab-4411-560f-a6fe-c383ad6f58b8
 10 cfec539b-7651-5b36-a33a-ccb0a68d1f2d
 11 1625538e-77e0-2cc5-9da0-d94476b9c89e
 12 e53a86e0-afbd-3935-937a-e057d98e3c89
 13 b56824cc-3ce9-3fdd-b824-5a5541f34b0f
 14 c6032a66-1af9-1cc1-bfe0-e5a70264c142

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 58072545552331. Exactly this sequence comes out of new Random(999).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 2 of Run 28 (seed 1,774,293,828): new Random(1774293828), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 12:08–12:38).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related