201209110420 zo0rg

explained decrypted filler

seed 982

Metadata

Post ID: zo0rg
Title: 201209110420 → 2012-09-11 04:20 on A858's clock
Posted (UTC): 2012-09-10 19:21:00
Timezone: UTC+9 · title 04:20 against posted 19:21 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209110420) = ba3d0688e7d976e8bcaf1c1edc2d3f33 (name+title)
GUIDs: 21
Filler GUID seed: new Random(982).Next(9) ✓ verified
Run: Run 31 (seed 15,917,281) (seed)
Draw: 19 · predicted N = 21 ✓
Machine boot: 2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

18216346D40E4D89 2B6E3ACDC5B24FBB BBC6A394BCB58130 24060FECBFE57E96 8F007D31E53D6470 A28FC93FFC86A2FF 3271BC55D6D52F66 87B1A7B6C2035046 A229823A73AE6404 B6465CC5A5A1F2A8 18C0695B7B4BD4E9 4AD85552110E9BC0 366EBF2922F6A948 3D8B8B1E081C734C F2EB5A3A6AE22317 9DD5B81E615CED47 5EE0AB2045118B00 52C2F5F71ACAE865 8FB5DA80B2BF7F46 3A7237250E68A0AD 2B75BE50DEC53E44 080912B99A8965C5 6DDCF434EE805B97 47314978CC39A732 5EA7B068A918A490 B8162A9DD41334D5 F48D7FDDF21A01FF CDC2ADC041E568F3 1D51F0F3710E7CAC 50F0E123120A9DF3 30CC0AE1AA494E4F DB17761DD74A2652 C65EDF2FF6A20AE9 9CA5FB436947588A CF2F33127A3CAA7B 9B8460A2EA76FA14 74ED9E452233E9C8 553D5C87B326B49D CF2DCD054ABC8497 44C69DA5D3E92AA5 B88A4FA155384C3B B3510EC868D6C13C 3557EC91816D767C 5EFD698AEF6DAA4C 2EA3B432863FE4BA BD0773ACC5B9F116 06D8ED65FB24D5EC CCD58AD2AB749EEB A4BA694204EA540A 652B3942F9F00D1B B43931CEA078D9DA 00696A593DFED9BB EBD08985F30D462B 5E5286EA4A0F99CD 4A9C2113871CCDF9 FA547D0FC5A63CAE 5E8C707C0D8FF947 7F3CF8D295754CAA BB30F1B45BA14B92 9F56E8C93CD83FB6 36396EEE7B27C154 C72C7B8BEBFE38A9 08059C47835E069C A88C9792A1E177E6 B1A2C74504BED6EF D64743EB6F2692D0 45A456CC8507D7D7 8485555E25CE56B0 8496889F312CE4C7 1B1DE4CAE129F1EB 4FEA3802204261C9 37550397945630C8 CF4CC16B60826616 1626B069E81FB892 A1DF6F33B2179F51 3D35481507AE786E B713FD9522A88CB2 434BE9E5FDDB9428 9A1E0A6CB913D5F2 54BEB21B6C9AD15A 4848DD42B3988FA5 9BDB0E093D521FE9 682A73869B5B30AA 8391DC7F4CBABEDD 0BD6BA8459CA428E

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209110420 (name+title). Key = MD5(password) = ba3d0688e7d976e8bcaf1c1edc2d3f33, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bf01eecc-af00-677f-a714-762ceac26054
  2 2a070224-c4fb-8299-ac05-edfd2b691d71
  3 f7b62f42-d932-1e34-8dcf-035c9fc0294c
  4 c09edaa0-7847-14c2-98a3-fe0530ded457
  5 ed250438-2441-54f4-976d-451029c62822
  6 c47a5864-05e5-61de-9bf1-913367a64291
  7 c8b7f5f7-33b9-8d01-9d8e-682edb1d725c
  8 d6d645b9-bfb6-00ff-9dff-6f839b23bca5
  9 12b37091-8f1e-4afc-ae58-e62fd22a5ee5
 10 9a774c29-f6b9-38ff-adf7-b5e6f4571a2e
 11 2a2cfdf3-dcfa-6ab4-babd-cdbae7991a1f
 12 c03a92cb-0761-1b6d-8fe4-36dc9df2cd69
 13 de2be929-9b68-64a5-adcb-1847845d1008
 14 1ec86e06-4093-38ee-b206-063e0a85af6e
 15 ea763c0f-22d7-3204-a3ba-d9f8512ba332
 16 29e1579a-4a9a-21ab-ba68-ec8b66148ad2
 17 9953003c-3c9f-55bf-8a13-7f25580ea822
 18 b2500e4a-d7b9-7e9c-b767-27733c1da6b5
 19 312b6e1c-105a-21a0-b72a-9966236b9951
 20 3bfc68ea-8cba-4c84-b069-e19ee57eb377
 21 22a29584-e919-26f0-9c7a-ff3feaf81fc4

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 681156804361633257242. Exactly this sequence comes out of new Random(982).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 19 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related