201208101734 y0ng9

explained decrypted filler

3DES(name+name) ECB, 13 GUIDs, seed 45

Metadata

Post ID: y0ng9
Title: 201208101734 → 2012-08-10 17:34 on A858's clock
Posted (UTC): 2012-08-10 21:31:33
Timezone: UTC−4 · title 17:34 against posted 21:31 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(45).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 36 · predicted N = 13 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

0690C38F8C1B2D14 264943A9D0814F40 DD75B315C14F5A3F 84DD9875C3D78CFA 19AE645D169DA3D6 1D64128A5AAB9FFE CFC20D7F6EB307DC 3C9F48107CC21DE3 55ABDB9F2D38B05C F32F3440CEBBB1CF 3CE1C76F54B1DCE2 3A78AB4C10E3CF41 9805B4112D92A777 D4E3145254201030 36BEAD498B9570CD 9480E7C40CB66259 C3CE3AA9074FF29B 1D6C0E5C47BC9BCD 234602153F9D8F1A 14046D5B61824D0C E0B6B981711374D5 0F70B719376B2BD4 DA6D91F5A8B43FE3 6D0A24AF08A5BD4C 95C88D1583A8296A 8B4B61C1A11E6976 17D0C12E2E72DF77 DE7A9423B6AFF624 4A5D946AC690B8C1 CB704A63720C3706 52DD7BF49F37BA9E 88CFE328B97D8351 CF16709144214C00 6F47378F7C024B0C 70C423B74B761692 E14EB3A120C3F679 187F97145A7EFE03 150D4B89D5370DBE C43BB50CF246D5FE 8D5FCE1D912F4A78 DB687D448E45D964 FF763B0B3F5C4204 FC0B38B8868F8D87 9629446A63A136EB 536AAA534670F5FC 9171A216824A7953 89296B880644C089 AE737ADCE9C65DDC 6121606C61B54845 0EA3C6AC109EBFA0 C27B0F66286FE2A4 92F0C000A4749150 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c499d5a2-b8d7-22b4-817f-684025344eb7
  2 5489ac2d-bbe7-0736-9c66-0ab50f9a2e1d
  3 99ddab66-9f4f-21e3-a645-f66beab7ffb9
  4 1be1ee1f-5ee6-1ca1-a64b-2f5961109865
  5 6610c4a8-59ba-402f-a2be-319869d03598
  6 07798d47-d510-7381-94f3-31d92c855d46
  7 e541b1e4-46c3-06fa-9101-b5d0c7e24110
  8 19ed4df2-31c6-015f-9d53-3660af87551f
  9 c77bfd56-8025-4d53-a8c3-ac174f22202c
 10 d7a8f9af-3c0f-7003-b241-904af2b8a2c9
 11 0bd0d54e-e165-4fce-994b-8b1c91852620
 12 6225559c-b807-51e4-a295-ee54fc64c8fb
 13 6c14e3f6-4655-5b86-8c8e-de466034c53e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2021470047455. Exactly this sequence comes out of new Random(45).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 36 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related