201209062330 zh1y9

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 684

Metadata

Post ID: zh1y9
Title: 201209062330 → 2012-09-06 23:30 on A858's clock
Posted (UTC): 2012-09-06 22:30:06
Timezone: UTC+1 · title 23:30 against posted 22:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209062330) = cbe427451260e5c9819e8a792af0d617 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(684).Next(9) ✓ verified
Run: Run 30 (seed 1,932,335,625) (seed)
Draw: 3 · predicted N = 21 ✓
Machine boot: 2012-08-15 09:44–10:44 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2E2482312A8E8133 58FDFE33093BF2F6 EAEAF8D971CF83CB 39C530EF8E74E55E 8D99118B98158124 EB4D5FA8F4FE8136 194308307CAD3F41 F19CABA7CC641047 F37CF38F9D4E4F22 1177243D643C8837 57FCBA53D5AF75CC B3028F3ED14B6652 249F81E3A3EF4A8E B266955BC4C6C26F 4D408093B66718EC DE9B30D502D24CBE AF5C6CCF7E454C8A F8533F51DEF26BCE FC138350A95D4F07 6966D9716EB68B15 E366E60E63B48C24 6A04F465946AC9DB 3B1C8EDCAAA2C423 DCD721497EBFEDA0 616676E3A4BE727E 24A49BFE62187BE5 D8FECC528DDF8077 D744ED74BFAEFB07 D3C04475B73BBC48 F3A330D764CC5B5F 7D04DFF2DD83612B FA2D371C5E94107E C06F3CEFC435CADE 670899E4DA4FBD68 93431C09225BBD73 8AEB03459C7BC241 4244A7A120293E44 1EC43506318BCECA EF3BA8B1BACD317C 9231B71AAB395147 15EF07DD031C6DE4 FF5695A13E29B670 6988FB1DDDAD5ADF 856B0529ADB05EA1 969FDA017DEBCEB1 5B02C0DE429AB8ED 67EC0A3D084FF624 8F3FCABB46377A89 5D552D71B9C19545 EEE6B9C0837A547D D25437B975C73F15 8CB23565247A77DA EC82510A7085874E B98A9E37865E5EC0 44731C03AF2BFA8E EBDD2BAF3C454209 302AAA95529DD589 07373481693D7E0E E422B89D1FA88BC8 6C02CAEB967BD287 524FEAF082D27EC3 BF6A20DAE34FC916 20ED86421A7954E6 4982EA6611A0D57E F83EEE446E48C7CC 5E7C357990C23E60 74213AE31CA18D4C 8AE2DC2CDF8BABD4 7C26CC8D32FA9615 69733A5E120CE4CF 61DA9E59654B76CE 165E3429A6BAE9AE 8C04CE3A80F89746 8B4D411DFF86B9FA 3D48C545CF3E8FCF C1AE2FAECE99DF1A D65795C2F5CEF74C 4354820E7B5E6945 175D03AFBEF2AF44 F9D9CF749F6732B9 2316031635A7595B AF60CBA8FD00B413 98D9C92701EA3631 A7E949E7F9C6826D 26D36B33B9715D85

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209062330 (name+title). Key = MD5(password) = cbe427451260e5c9819e8a792af0d617, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 88de60f4-e416-0af0-b8e7-8bf1f7ff7c2c
  2 7987b509-e7ba-478e-950e-f632ff931ea3
  3 6896f057-9425-7fe2-95fc-0d059ac5abe0
  4 e8557f2b-d60d-4768-91cb-666961555883
  5 820b30b4-c60c-06c6-b395-f76fd8a7b57d
  6 710788e6-eb9d-2c41-95bc-88f4436bf1cb
  7 15b4ff0b-b332-3b92-a178-bdaa94f1e6f5
  8 2a101f81-0a52-5856-9fcf-79625fe3640f
  9 75f2e926-1b27-52ac-8eba-e96723d60fce
 10 52e263a6-2a61-4f7e-a759-8d6f2c37c998
 11 5845c5a0-fdc8-1475-a9b9-388b07fd16cb
 12 245f5a91-d5cb-42e8-96c7-94e5625e88bf
 13 d7d88a8d-f10d-77c1-a8f3-fe3366d70ffd
 14 88eb434a-148a-22e2-ab5e-436ff6cd2147
 15 23ca0ca4-7246-66d9-a45d-0e52ac0bfb23
 16 93353835-2fbf-109e-853e-401b30dacde4
 17 b24fdc25-fd5a-30d2-85db-f9f18f09d2a1
 18 c40ae91b-5227-0427-ab21-6a9b9565e6a1
 19 a6ee9bfe-2c04-1c46-9a62-fedbe629a556
 20 2221652a-f1e7-158a-83cd-540c5a1820e4
 21 dc3999fd-7e2d-6b2a-80ed-6599d7d69744

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 047402355414726130116. Exactly this sequence comes out of new Random(684).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 3 of Run 30 (seed 1,932,335,625): new Random(1932335625), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 09:44–10:44).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related