201209051300 zdjxo

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 267

Metadata

Post ID: zdjxo
Title: 201209051300 → 2012-09-05 13:00 on A858's clock
Posted (UTC): 2012-09-05 04:00:11
Timezone: UTC+9 · title 13:00 against posted 04:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209051300) = 4416355ab411e99f167c17d1f9cc4a6b (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(267).Next(9) ✓ verified
Run: Run 28 (seed 1,774,293,828) (seed)
Draw: 5 · predicted N = 22 ✓
Machine boot: 2012-08-15 12:08–12:38 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

21C9976B916AEDFD C30D06196CCE71F4 1E4C5D4794B2284E 72A5215B87EB33C6 C183EE82C93085A7 E7BA6CC04E029E54 F0E7F514613AAE05 2E33E00ADD315E8B FB1F3C6383C7BB83 269FB0AB4F193F8C 584599FC09B84141 405F158071295C48 68C4415620F3D448 D474AF152D898A4B DDEC3961A7A89651 F008DE930B99593E 3F7838182B8BCEE1 D3F1387810EE6BD3 B5747C24DA513621 D453E8CE36847767 F7144C2794A9BA37 C2852B88C1C1E0BB 6BFB6C8F3D775A6C D4844089C8659F02 82F7D8F1C1EDBF88 03C25BDE8ADBE052 87A1E01C6B4E54DB DCD0987569939C50 691E9D88F57783C1 B60B2B9CF77F3741 EC0B98D58D35F113 99157E8D8FE2EE4C 623FFBDE2F7D619D D25D6EAB040BCDD2 41087B91A253FC3D CF3CDFDA573A95E2 70114D95C0C65442 6F6D815BC4FE630A DD3145EBACAB5D17 AE47E3179DA51E74 32A8A520D5F68CC0 A62C68CAF198A0F9 BF2F036D513D27DC C83DBA17757DC0C4 0DCF4431218F053A 7FD06AF144DAFDB1 568ACDE24EBBDD4E 69FDBC06C930A5CA 22965C98197745ED EE4C9ECDF6414DD7 AB9EA126257E2467 CCE6EFC16B5A42C5 2331295BB70819C3 9EDD31AA47AAF734 11DA918B68EBF85C 335B2FF9B5363A29 25D9A53CB8BF71DD 3FBFA09058377834 302A2236F392C9AE C4B074C76DF7680C B1A662C3DA168088 186095DD12E055FD 1267A5D65B0BDF1E E41DAD51555A612E 599AB6DE4FDE42AE 31FEEDC54DDE3B4B F81673E28886D97D A630787E78B5C2C7 DBB006837E7F36E4 C74FCBEC201C8228 BE991624D1E9DDAF 9F74396CE8B6C879 46D580ECD64AAF8B 2AD055B3D6419780 A8404A8F38B3C440 EA12C314298CE2E8 E6AA1C577B92425A 5F9DC29E16AA2B59 E0FC642A82847901 F0C988E337D13ECC 39514FA7C4FB3AD8 BC7E0FC30704C36A 4065F57BFA60D403 C0259F040BDF18C9 5DEC149CCFBA0ED3 A5EEA9E5B83BF63F D4BFD26073085F59 DBE00FFD4F4B64C5 B8C6CE9A9CC14DC2

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209051300 (name+title). Key = MD5(password) = 4416355ab411e99f167c17d1f9cc4a6b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 767965ac-0f69-126e-8b0c-95d10e6fdb3d
  2 621698a0-3c49-15fc-b41b-12f8c0b9faa8
  3 af70c36f-0842-36a6-8ceb-30f64d0bc599
  4 fc0c051f-23b2-4f91-ad76-0c05e9e555ed
  5 a02a6bea-cf8f-61c1-9f98-4703bceadad6
  6 929647d3-be22-8629-b2b8-b6dbc4d40802
  7 8570ca85-57dc-4d5e-9e04-ca2ddd776706
  8 71490ee7-b2e8-3f60-b9ab-a33ef17e1b60
  9 91122eb4-2d6b-01fa-ae60-9d1b83789d72
 10 9d9fe2ef-6a5e-6020-aff1-8143a06ef62d
 11 6cfc8f64-1047-84e6-aa7a-50a63dac5495
 12 4961e29e-795f-8870-a171-43aed3283491
 13 725cbbd9-ff0e-13af-9cc0-9f53cf090f6c
 14 788dac46-f6cb-35e2-af81-b964cc5bbbd4
 15 851741ba-6c1b-7965-8162-a7dcbd424634
 16 958ab7f1-2a6e-6e1a-97a8-0e50beb2f280
 17 dbb5f91f-2449-09ce-aa3f-b6b1ae138ad2
 18 abc13b64-aedb-4545-a536-c50e51a38aad
 19 eae11f48-32b6-80ba-90a5-1c40e9d0ba8f
 20 fc7a60b3-c4ae-6497-b361-d08789f083d0
 21 34993426-2ce1-2780-9a24-4ac03d68cb35
 22 6c553e91-fff3-3f16-b147-25f9b60111d9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1134684306881376048623. Exactly this sequence comes out of new Random(267).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 28 (seed 1,774,293,828): new Random(1774293828), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 12:08–12:38).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related