201209051330 zdlo3

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 286

Metadata

Post ID: zdlo3
Title: 201209051330 → 2012-09-05 13:30 on A858's clock
Posted (UTC): 2012-09-05 04:30:12
Timezone: UTC+9 · title 13:30 against posted 04:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209051330) = 8a2929dca1cd5b3f23acecd4f0602a8d (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(286).Next(9) ✓ verified
Run: Run 28 (seed 1,774,293,828) (seed)
Draw: 6 · predicted N = 9 ✓
Machine boot: 2012-08-15 12:08–12:38 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 3
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

0111920C3A640924 64B1030F84560C9D 382D3BF9C49D041C 0B766574E35EBBCB 3242934B591EAD5F 0CBB5AD634CE52A6 EA9A210008C7B250 A390520DEDDE5044 7B38B69F03237F9B 0F93FC2F39176CB5 BAE32AF41699C1E5 EE48EE6BB06E2813 37FA0188BEBBE91B 7165F67F7EC2612C 128A179B86A81E0A E36D41096132B7DA 560DC3DFD284FBC7 DC1800443D09CA36 C74D9CDE0861D136 4BEB4EBB09B5A5AA C37A32EDD057AE03 17800FF5933E168F 69DF02F1C2F2E900 D50F108DE58D7604 A2E3865C787ABE97 7ACF6C8906A977EE 8EBFA2072082F00E 99F7EBD1AF187629 427204C07FDC194D 809976EADDA81287 8767CE8E751CB49F DC8FDF8F1258A7D1 B38F8763524084D9 5CEFC2C08DEEC6CE 2516A5BAEC494527 B8F264F5574E6294 D98F2C0DD2E44BA8

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209051330 (name+title). Key = MD5(password) = 8a2929dca1cd5b3f23acecd4f0602a8d, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f9951ad5-f8fc-1417-864a-b0e5565d28c8
  2 e033910f-154b-6f30-8452-0bea84de53b4
  3 8f361bb8-6b04-69fa-b4d9-af4f0c91483c
  4 9d22abee-cd87-5d66-b36d-11ca835cc30b
  5 0152f8cd-77e1-2667-bced-3775ae9fb999
  6 15855cc9-943d-429f-9a72-cc26dc2c453f
  7 2eccf6bc-2991-0522-817c-366946ccec7b
  8 8674a09d-c13d-82d0-a6bd-2446fe988d1e
  9 5b2ca896-06b1-3f9d-abc6-a32bf1d4433d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 166524083. Exactly this sequence comes out of new Random(286).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 6 of Run 28 (seed 1,774,293,828): new Random(1774293828), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 12:08–12:38).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related