201209060100 zforu

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 199

Metadata

Post ID: zforu
Title: 201209060100 → 2012-09-06 01:00 on A858's clock
Posted (UTC): 2012-09-06 05:00:21
Timezone: UTC−4 · title 01:00 against posted 05:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209060100) = f5eca2b0c1e673968bc0b586f33992e7 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(199).Next(9) ✓ verified
Run: Run 29 (seed 1,844,859,734) (seed)
Draw: 9 · predicted N = 18 ✓
Machine boot: 2012-08-15 10:32–11:32 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

45F8563A04213728 F5CEA769180101F5 7AADA1655775CA40 1D2DE60528DFD9AD 8805B6B7C07C20C7 3C55F5960BBAD634 A60996D113020164 72616B1C78D0C154 9D2A8F9299053BFE 5136D45FC877EE17 A53A3BBFE8EE26B5 7A210FE3D75C1560 4E91F751D2E4136C C915EE841806B5C8 E17DCA4BE07E4220 0A3B058F1AA14263 01BF960AFDA96B65 75D08E674B0973E3 2FB37E286207F87F C87CE1C803175926 A174646517751131 D4EEC75C3D64E326 41E4AB4037F72152 E66526B0F3B08FC9 55ACAE2966B72AA1 EB8FC0D1654C7654 8A4F9884204CCD19 C267FDB15108BF3C A8E43829AF83B4B1 C56A5AE39CD770F1 025FD934F6A0C6BD F51A533AF1A82BD4 A2DB9B45773F5F19 65757A2C9AEC5FAD 487F119D8A0A23B3 68C03CF9717D4276 8817C16CBD6D1104 DA3D1EE547F955AA E62957B4202A3FB5 93194AA3E5A2C8F6 CDFD72763218C977 F0679F0A01D33CB8 59C477A336A1C440 FCE634D97D752D22 6FE915233FA9EBC6 60DF06954D5D5176 F9F9DA4DC490795C B761E117B1E337EA E915394F7E9FC8F0 E4F6FD1BA804BDD0 23CEA11645D9246E 58FD7E44B041B396 9604C465AE5A3B31 9134C6365962CADF 967D23432D988B12 20747DC52BE5F776 36423F987652072A 50EE5F4B9B43C556 F40B12A4E07527B8 FF75D918ED8FCD7D AE49336B9A0D3BD7 C704048E325B7386 D36564C9FCD94AB7 626A14726EAA44FF BCF71C83F41B2F05 737B9163205E8705 94CC6F1E6A192F21 D7A428593B488565 A33DF80DDC211C74 7D2FE7871BEC4DC3 F9BB25CB89DA57C4 C92BD75EE2EA9299 CA1E0AE35DEA059D

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209060100 (name+title). Key = MD5(password) = f5eca2b0c1e673968bc0b586f33992e7, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8f7eae59-ff41-657a-8499-095d26a9a9f8
  2 a104c7f8-b9d6-14ae-bd5b-375d860082e3
  3 86b391af-d4f8-7bd4-99ce-df4d95483a20
  4 8b8e1129-b29d-0683-93c2-27806957409a
  5 4a1af26a-63c6-06c0-b4a7-bc1ed42ee900
  6 2dc23fce-ca9b-4445-bc46-b1b265844f81
  7 a747368c-ab87-0868-b0c5-26a9afa0066f
  8 852b2608-918d-27c9-b01d-2ce4d424f323
  9 2e389396-3775-53e2-b7aa-857ec40a0d55
 10 a44460e9-7fbe-5618-8420-f9dd5fdc2ce0
 11 fdcfa069-5cba-8768-9786-64ada3be5c41
 12 16eb1c1b-863a-7e1b-a4dd-5ddb235a810f
 13 7df12465-ba21-3915-b3d8-8cce0461d99b
 14 020563ee-b0eb-0eb9-b7f4-3cc2a705920a
 15 018f7843-272e-2bb7-998b-2636ca9dafc0
 16 0bf030b9-00a1-227b-8aed-636f27e2f48c
 17 203b5a37-76ce-4a84-bfbb-6fa83137675a
 18 ecd91c54-ad88-30d3-8d8c-07cf9a94844d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 617004025587302243. Exactly this sequence comes out of new Random(199).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 29 (seed 1,844,859,734): new Random(1844859734), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:32–11:32).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related