201209091200 zl3oi

explained decrypted filler

seed 896

Metadata

Post ID: zl3oi
Title: 201209091200 → 2012-09-09 12:00 on A858's clock
Posted (UTC): 2012-09-09 03:00:01
Timezone: UTC+9 · title 12:00 against posted 03:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209091200) = f57297d5668289a866eb64711e2314da (name+title)
GUIDs: 14
Filler GUID seed: new Random(896).Next(9) ✓ verified
Run: Run 31 (seed 15,917,281) (seed)
Draw: 9 · predicted N = 14 ✓
Machine boot: 2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

74F5A8007F4DFC29 33CA19039A2776E1 3589DA764945F2A6 28825AC980BB85A8 5EA6DD3D2A8109B7 E0C514176362735C C2E42FEF941EE967 453B800836A91CE3 FB8C1CE413DBE37E FE39A1B89BABC16C B980F6D6635BA8ED 4B74D6E17F6E2E1A 55657F3701006CFF C65C8B7B3B99F4F8 6BED8E530A16E304 0FA97ABD58BB0106 E97F6C068815B4AA 519EA50162A65243 BB3050238E945E8E 085B9B0A1D13C54C CAEB50E798985B4A 8D947626407DC6C0 B760EE17374DE0B6 F85D8EBBDFC3AF48 51FAED6D7FC010CB 0369B52C32CF12F4 CCDB1E74F8629183 CB6FBDD1A18D5C58 A2025B6D1639A14F EBA115ECBAFF9836 93D16FFBEF58FE9F C2F7E906752BF404 72643BE983715F27 C4297A3607137E48 665A9307326F3A95 CF961D6AB7A7FF16 C901E2D001AFE058 E2536C20546915D2 155021B99077E22B FA198C45822CD28D F50952B4AC2416C4 A05C8CD5A91CE32A 70423A23407D5AD4 91499202D4CB1AA0 9F9A85565D356C16 7857956862349C4B 2E6901833F38B870 6FE23ED99C651DBF EB191C24BBE2CEAC D95A98FE8C79D233 25F1700907EF2CA4 4946C15DA96C4E99 BC60A462AE559D77 B71F883A6B8FF693 658690C888C26806 28721EADD7F5E03A 57B4ADBCAAE0202B

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209091200 (name+title). Key = MD5(password) = f57297d5668289a866eb64711e2314da, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9eb4a9c3-d35c-7bec-99bf-5e32b3f25ad8
  2 0245a726-af2f-6d23-b5bb-accb06fcd17a
  3 c128449b-d8da-071c-8b24-ebe1a84dc4ff
  4 bb96bfdf-22e9-7032-9957-739f62bf5d94
  5 2a8c33b3-10d5-62b1-903a-319bc9a5bacd
  6 2341470c-fb17-53a0-a7b1-14e618204dc4
  7 a531f638-ef54-39f7-9240-4380abfde8d8
  8 d26d9c6a-7e4d-8e63-954b-d671a35e0190
  9 db6c203e-6f53-709d-a0f4-076053793237
 10 31c518b3-6a30-6360-89f5-ea1a2e1ae50a
 11 97d34b71-d925-34c0-a371-22ce6f8bc11c
 12 166ded4b-424e-8ca8-8254-ba5bd6cc5533
 13 e6e1b4f6-551d-5bb1-87cd-d864c24c349c
 14 bfd4fc06-bcb5-58a7-bb71-7383e7e44eec

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 76076538763855. Exactly this sequence comes out of new Random(896).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related