201208101748 y0oay

explained decrypted filler

3DES(name+name) ECB, 16 GUIDs, seed 467

Metadata

Post ID: y0oay
Title: 201208101748 → 2012-08-10 17:48 on A858's clock
Posted (UTC): 2012-08-10 21:45:34
Timezone: UTC−4 · title 17:48 against posted 21:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,040 hex characters · 520 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 16
Filler GUID seed: new Random(467).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 37 · predicted N = 16 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

C2ED296403CEA6E6 45AD37E665799A71 BEB6BCB3D7BAC77A 62339036917D936F B8322BA9A84594CC FE573FC6B0E0BE9E BC08102DADBF2017 98C1EEC5E6674BD5 D41B24531C679193 FF845358C19EF3CB 364DE3E36F09FDC4 DEF8676B6E615EFA 49214338D0727882 56BEE53687FF40A2 BC57C14498C15CBC 50552FD8AF3E47BC BF50A1A2C1362EA5 981310CEA208804B 4D8C19ABEDA951BE 2652F554121BA35F 43ED120A1B628DB8 22E021E1BD7DB9A4 0F665404073BB3A0 D65BDEAE0D55051A 5FEF97ED14E16A33 14312EC1FADD6F9C 23A0B5CF01846761 72C4388DC5DB569C 4BA6AFEE75E881AF 45C0EA0568C6393C 5C40E56979DD1990 2B28EA56F4DE3300 17070CAE89CED838 C4FA6CFFE7C80A40 46E991C3628D9999 9B6E53C85162407B C95BC0EA4FA98937 315EDB1206BCF72A 2F2633A30582852C 53FC88AE92C529DB 512DF5D503A8AE05 A3EC73807C1BF0E1 F3E0F7C8DBE4B01D FAF1F4C82FFF6DBB 56AEB9AC8C5FC115 EE9A9553A24A7D6B 58DD73FA456773A0 8F3137B20BB9C231 964049A6B9D13CDB 13A0C5F31B23CF36 7510DAA110ED371B CDF0BC8A37FCC411 7D8D732980753A21 2B4328F6B0A86312 E2E453AEAD6857A7 C56FB3AB48EE4C94 391A2244A6116C69 277B74EBDB03AD5B 7DF9A9D97CD47D48 FE12E16A44C8B098 DA4651F7CC5CA305 3AA69F058D19A74F 3A64D791BD5D5019 393298A7B0D7E10A 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f83982ed-7950-6446-8c34-b70724d39468
  2 2144ce1e-c0ab-7503-afe2-1008e5dd5e44
  3 01a3e428-0555-10e5-a05c-8cd187e1525c
  4 61f2650f-19f9-29d4-ac20-081d9c2e0f65
  5 0fcab634-8406-01bd-be0b-75fd5c28f6da
  6 d7092178-a2b9-6c0e-959b-8ed0b1250169
  7 a28e07bb-ba2c-1f16-9b64-cb05a9d98d14
  8 e69d94f4-dc8d-6802-8405-03e26b1b0657
  9 dccc2c90-a6fa-651e-a512-70956758b9db
 10 e3c9d092-4254-4ea0-9d6c-0c70025e5e95
 11 114fe323-e6bd-3fa1-a8e2-6ba0f081f07b
 12 be819722-f1d6-07c2-9452-7cb9ac8ddfa0
 13 0f3c5aa4-e1d4-6e0e-bee1-3ff82c1d94c8
 14 82440f6a-b252-3332-9065-030e416cdb9c
 15 194f35f9-4531-7a27-bf05-6e23352cb8bb
 16 704c72bd-5486-6551-b963-dc87b25eab1f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6712061664306376. Exactly this sequence comes out of new Random(467).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 37 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related