201209110430 zo1b7

explained decrypted filler

seed 272

Metadata

Post ID: zo1b7
Title: 201209110430 → 2012-09-11 04:30 on A858's clock
Posted (UTC): 2012-09-10 19:30:05
Timezone: UTC+9 · title 04:30 against posted 19:30 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201209110430) = efed200643ff6feaae313375c3d00b4e (name+title)
GUIDs: 20
Filler GUID seed: new Random(272).Next(9) ✓ verified
Run: Run 31 (seed 15,917,281) (seed)
Draw: 22 · predicted N = 20 ✓
Machine boot: 2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FD78E676C18FE58D 21191D9911A0F332 504C99EE0FB31825 A92074DBC7FE5676 E848A72F55AF28F3 8B029D980F0BE42F 4F95CBA4A83D4992 D73FCB2329720120 C6297227B8661CCA 25B6925A63D7803B C0F9708FA4CB9953 FB434703462F773F 0F594365EE50C50D 66C3D378525B9CB2 311600C2725F2647 90CFA896F1DF4AA2 AC34A4F493298309 346D1AD2413C1799 54ED87267D475B94 E3055246402222BE 5C367F871B81E683 7DC6097C9951DC84 C688DFFFAEC00E01 C856101457683B4D 8A612E7848D01615 750E1E458A9FF756 D6A112926051A0FC 683FE108BE0AA997 EE8FBD83A5725F64 E632F4DE92FE8B64 422B6ABFC8EBD379 B0D7FDB285C4A4DC 3DFEFA8A628A0ABE A8EEFDF45AB101F9 6AE824135801400A B4EAD5BD62556F4A 192327D810B70E58 FAD4ACA28F226979 AB391DCCD61DB373 415A25192989767C ACAC7DD79EB6E1DE 7B6E0F7CFA3B6B8D 36E364291B28A835 2AEE755140076BD1 BDBD976611F4910D E46F55113A024C2F 8652BBACB4FA5B38 ABD375A35B115549 4159CFDABE9E636D CB927D62371C1C32 58B5533B89A5D508 E968777B25CFA52E 78392CC855C1CF7E 494980E784CAAC70 5E6E440F75F9DDAA 62FD78F4F66A68C1 37E391570CFE8811 7F41B8234C49F0BE 0BC098EADF2C01B8 B629808E2C23CD85 DDF913BE0D199BE1 E85A4F8D8BEF1FB8 23EB30F5341180B3 A3A1A682D954EB82 B879B3445C9C16C7 A3BD541364CEC2D2 7350F9583485831A D37F6BCE4D3AE094 5C33407AFE63121C B3FEB072FFE1BDD7 4E7CE79510A6FC80 2706DE22D1AC2D37 B5EE08E8E27E676C 372F9D1CC1350D78 C6A159A2CDD2CE5F 9DC98DCA0A300E41 987948662459B3ED E0DAAF9FD8DB04EC E09823A73A9C9315 9ACBDE88E3856D04 36E5F259D09379B3

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201209110430 (name+title). Key = MD5(password) = efed200643ff6feaae313375c3d00b4e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 53d93441-ec9e-7cce-a1b6-7493eed8ff6b
  2 929423c5-6126-5a57-88f4-59fecd4e9a32
  3 8805a880-cb81-8cb4-9b6e-754d64d00cf1
  4 06ca0076-ba50-560e-928b-bb073c3f9952
  5 3ba56720-1881-020b-a224-4422bd6a1994
  6 1e0b573e-4725-2610-94cd-f03f9eaaf6e2
  7 046deecc-3357-6b5c-9b05-523797b097c4
  8 391b841e-f71a-8953-9869-fd8289f9f296
  9 84ab1730-8030-5d4e-a165-af4ff7c09ca9
 10 53e53e01-fd1b-5703-88d4-0b670e64045a
 11 80bdee7d-ef30-64d5-b9f8-30c41dcddd13
 12 51ac6f63-e366-766a-a9bf-baf58b0449f2
 13 eae4cf38-8867-5610-94e6-5682573e7703
 14 363ddfde-7211-8249-a891-98f07405c3a6
 15 0036eada-96d5-317f-8149-cc7386ab1faa
 16 658499b3-d173-8392-851d-7d7305de85ee
 17 fdbc81df-c1ff-1722-990f-6b6f5b3e8b23
 18 79cf3389-e938-5380-8317-419e7bc2a664
 19 3b3a007f-1959-0796-a46c-643afdcbd244
 20 7b026053-cfb0-581d-8828-acafa72934eb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 75850268556758381505. Exactly this sequence comes out of new Random(272).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 22 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related