201209110427 zo14i

explained decrypted filler

seed 321

Metadata

Post ID: zo14i
Title: 201209110427 → 2012-09-11 04:27 on A858's clock
Posted (UTC): 2012-09-10 19:27:04
Timezone: UTC+9 · title 04:27 against posted 19:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209110427) = 2baa7707af4cfd2c7e27c2d032d818c2 (name+title)
GUIDs: 8
Filler GUID seed: new Random(321).Next(9) ✓ verified
Run: Run 31 (seed 15,917,281) (seed)
Draw: 21 · predicted N = 8 ✓
Machine boot: 2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F1EDC54B0DB690D0 64B64AA3873C672F C2831A17745F4921 7DCE354BE3B7878A DD17060D1E424B43 8E6242296FAC7007 1AA90192F23EDF8E 11CD45569A46A804 79EAA20AA0D5F545 8961A506ED1C56EE 914A128F08D38B26 F3671547CC2652C2 076E215A36628840 0856E54BA7528EDE 1D90F425ACA2890A 506FB733F299C988 732136D9F37CBB94 883B7F7A41D94B72 CAE13BD0D33AF50E E38B4372D713070D 009CC09AEDA7205B 5050AABE5F65E974 95421BB4F7065232 3B88D7A4926B8011 9223D4BC1D724FAA A1BA0C8B473295E1 4186CC183B0A2FA3 BD2858DA50878FAB 45472043AF678A62 BE40C4C7C5ED30DB 2C33804AF12D58E7 5CF7A9D2F096B8FB 52E9AD6AEB1475D7

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209110427 (name+title). Key = MD5(password) = 2baa7707af4cfd2c7e27c2d032d818c2, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9ec47df2-183f-303b-8dd9-3c6668310312
  2 d1162701-b8c5-0e17-ae3a-d895312fe669
  3 34f36b6e-3460-1a8b-b8d6-78ecc735ec6a
  4 c684184e-f357-0eb7-99d0-a85b52c6b4a1
  5 5570e84c-bed4-1018-8c3a-a7b08a22519d
  6 66ea8629-578a-0e5a-ab5d-0280b13a7f3a
  7 9a736435-4c3b-6046-a682-80e1855edec6
  8 edcbf813-115c-46ec-9b1d-58440cde794a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 30101064. Exactly this sequence comes out of new Random(321).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 21 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related