201209070130 zh9k3

explained decrypted filler

seed 135

Metadata

Post ID: zh9k3
Title: 201209070130 → 2012-09-07 01:30 on A858's clock
Posted (UTC): 2012-09-07 00:30:09
Timezone: UTC+1 · title 01:30 against posted 00:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209070130) = beb0f2dd1205f261025a32f88f0a4700 (name+title)
GUIDs: 9
Filler GUID seed: new Random(135).Next(9) ✓ verified
Run: Run 30 (seed 1,932,335,625) (seed)
Draw: 5 · predicted N = 9 ✓
Machine boot: 2012-08-15 09:44–10:44 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D50D4D60AA546187 2D73FCE7D34C793C 59013764F0B18167 B749E66907E19812 8DE548FDA8F11B87 06330D260CE7CFCA EE764246BC664770 42E1C4AE5E391E17 BD1490D8DC2012A2 327F371AD2D7AE1B 75587FB9CE12DA62 93F2C2F03489CC4F B704B03B2176A3F6 48667FA569EE64F5 4A1FDF4B02FF084C 530C19D2AC90DD89 90D559BD67E689BC 8A7A854E663700B5 C9439A95A789B939 468F447EC363BC68 85D8A8DADAED4FDA C5DDC6271317F4B8 E7953D7E22D91892 C653BC3691C572EE 622F44326725C0FB 867A8865D4FED6DA AB22737FBB4B9E77 EC5E3B629B85BF15 DC05DAC1FD81DF71 EBAC0CC636A3854B 596E07B21CD4E03F FB3C88EB93953C04 C744754E5A16ECA3 48C5E249FC3A5475 72117B7CA9C61A21 5D1CF79617756F4F 20E45D05B07CCF5A

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209070130 (name+title). Key = MD5(password) = beb0f2dd1205f261025a32f88f0a4700, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 34b4f611-6330-29f8-9e46-aa5cef958e2a
  2 52e9eb6b-648f-3258-b898-9a0c208fbda1
  3 0d5214b6-34e4-158a-ae53-86e5a733399a
  4 ef591598-396b-355a-80be-94d7bcbccb92
  5 c0b77957-7d06-1eca-9337-c8079fbc2c5c
  6 14e0feac-bf36-49a3-aec3-df2c66925578
  7 bbf03abd-b287-3ba5-8693-2ca2ede27c54
  8 4a2a476b-1304-15f8-adf3-b98d94dbaec0
  9 ee3c1fa0-143c-6324-8f66-4a7284e08743

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 231314316. Exactly this sequence comes out of new Random(135).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 30 (seed 1,932,335,625): new Random(1932335625), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 09:44–10:44).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related