201209080059 zjll0

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 847

Metadata

Post ID: zjll0
Title: 201209080059 → 2012-09-08 00:59 on A858's clock
Posted (UTC): 2012-09-08 05:00:00
Timezone: UTC−4 · title 00:59 against posted 05:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209080059) = 89c1e6a18200ff1f9d2d1191b91d8e90 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(847).Next(9) ✓ verified
Run: Run 31 (seed 15,917,281) (seed)
Draw: 0 · predicted N = 22 ✓
Machine boot: 2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4D835F7312554923 AB12793BA735D3F1 50DC33DE60E1747F 59F5F069D781A459 7F9BD98E9421AEDC C50F9CA8FFB8F126 12FB2646F9CADDAD A4157B88E520C97A B3B533CD6F16ABB5 573F0A41DCD418F2 D4F3E4B8E1CCEBC4 9B8F5A2CBBEBA00D F645D7A1E708BBF4 4F4195C7CDCE9C04 E3D204E05013A73D 7FA09F496FF53E26 49A07752A3344C98 425C7D145C66345A D70516B2A4A9E611 C4DCA8A28D524E65 4F0177994E5B44A0 B18CFD833962C0F1 BE49747B7102FA04 3C3F2EE7A64F12F6 85E969BA99A63BF6 9DC76F53BD314BB0 ADB5EA0BA7B1D022 537F8743533833BA B7EA865E74961E35 9A6DB0F217CC4CE6 7ABC09E6F4FEDF65 58DABD421AFDA4CB D47BAB5810EEE854 E0E2CD2624A020B9 8A9464667EE1228E D321037FEF35BF8A 5EFAA97F30C3FC81 29A8A347E0C09436 8380DDC3939D8382 25D7F14B5D45AF0B 939DABA867E32BC8 AD741CB889D8AE98 908E4C6DE0F3612E D3EA7350F8C237F4 7A8314D4A73D3C64 1125FCE02DE4D6FC EA474B3A46134880 B3FFA59FC871E2ED A900AFF4FC1B5253 DC2BEFB2F591C86E F63D9A0AAC4D03CF 289184A845ADA622 D1C2809BC1A136AA ADA8857A1D565100 3623944777326E98 EB16833B2EE1F9E8 FD59C313D6EC2E5A EAA672447E6F9E77 20768C0B0C7F1F38 0D789BF1B98D5A17 75464BED4BB4D240 998207C3566971F0 6E8A742CBF5C4CF9 A453D230BECB221B DFE91B6482D10437 3AF964E067B8C047 F4A8A4407C94140C AE1952F6D1EF83B6 40F080F1E06AC388 B04DB707B7EB8E40 FF0017ADACD192C9 B6ACA3714B101DA5 39B4DC7D0C6160E8 0F3E48FCD2F39050 6D744993EAB37BEE A67169FDBCBB6F86 9207AF3E8538F91A 3752ECA6E617D91A EBA96C11B3CE80F0 9D58D2676A806F9D 6922A8BF10FFE3D8 2E10F317C672EA8E 8836550FFA76B35A 8DB4B00C7BE626C3 976757B9CB4DF6F7 7B70FE431496DB13 F59EFFDA20C8344B 80463886753428BD 6891942D9CBD1E55

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209080059 (name+title). Key = MD5(password) = 89c1e6a18200ff1f9d2d1191b91d8e90, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7a11d7fa-ef15-1f1f-9118-012d0a9265fb
  2 aea8df70-e393-33c4-80db-26352a16a3e4
  3 9da3949c-b03f-7396-bb5e-ddbc5d4828cc
  4 fd918123-a3cd-36ab-83ed-cfe95bb15aaf
  5 9246a655-7671-5200-be31-6d7c9650cdf1
  6 2dab4081-ed33-6e7f-8894-6f2eff0bb7a7
  7 8f1da763-f640-3cd2-81b5-b7a4e9f271c3
  8 14a24da3-e962-33c5-990e-689603f6b2ba
  9 9552c2b6-42d2-6118-b4f9-0f990dc24df4
 10 499bef5f-74a6-5534-bbd1-595d4ce5e1d3
 11 8ae6bcce-8638-27ab-bb49-fba97fa19f67
 12 837a9edc-f7a7-67bf-a420-f483cdb72e8a
 13 ea99117f-8cf9-82c8-87df-c8f35cd861df
 14 2932ab8e-37d1-1001-b214-7e2bf7225610
 15 7401ce13-559a-762a-801c-0169cdabf534
 16 160e5a26-3f64-8ea1-b920-7be3ed4f9721
 17 06af5d22-c377-8c32-8441-0e1dec8199ae
 18 89f5eccb-d3d5-17b9-b829-7d8941f81eca
 19 cce1f45c-299c-5e7d-97d5-4dc7284ddad5
 20 4db6b9da-1649-24aa-9eda-18c3e11f69ad
 21 1a4fe19d-d304-34ef-acda-de78fc1e17b1
 22 e6d4a222-852b-5c0c-b14f-819f56007c23

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1373563365268178815235. Exactly this sequence comes out of new Random(847).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 0 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related