201208101802 y0p4n

explained decrypted filler

3DES(name+name) ECB, 15 GUIDs, seed 467

Metadata

Post ID: y0p4n
Title: 201208101802 → 2012-08-10 18:02 on A858's clock
Posted (UTC): 2012-08-10 21:59:35
Timezone: UTC−4 · title 18:02 against posted 21:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(467).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 38 · predicted N = 15 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

46C80F42156BB6C1 9488AF39D63D2C8B 2E42BA613741EB56 7E38FF565566BE1A BDF1999990428059 EA35663A4CBCA35C 2D07372118F62047 72F2A505C891FCC6 FA12BFB77809B12C 859F0BC22FE626E1 01076D24B1EB1D27 351DB3D2CD425803 8B3997B50A1CB9EC D0B6AC6D7DA0C1B5 2CE786AA098DC3CF EC141B738EF6B3F1 0681FFF6D1880E38 5F46C7B29A54EAE4 D668514B4094D764 E085F33331C5EF09 94D1657FE7277B24 C502272365511F49 9B192BFAED8D2BF0 36B1D4FDD69FE81A E4060D6EFA31C734 9958EF44CA8BDD78 F68E75ECCCCEE378 944F331A833F217B E612EDF48A710F31 18F5C21415EF63D4 2C6417EA81880EEA 25F68052DD449069 04C53AF188677909 856D04453EF245CF 77D436E22B712CED B1E7C2ECAF732B55 A8DA7606FD3ACB0C 39FA7147402E2345 3DE649E5360668D9 79714D6304F4F103 01E043B2F4EB0D9F 6FC56D31EB2687ED 9B3244CB9DC93D14 110B948339E2C45D 8A15F56FEEBA2D53 80C9044D8220BFE1 35DC5471467C5746 0A0B7774712D2EAA F8BD452137B53B9A 9F8942934D3A96E4 F5C9376531622C2E 1E9395715CAB6DBB B45D346DF40C6434 17E3EB47C0C09755 8213C0F291B08B7B 9B1E560475E4B828 327AFF242672B7AE D4B52CEC1362EA60 3B1607CE927E8D63 D78EC23E65AC5E5B 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4deb70e3-ac18-6741-bc49-5843340468cd
  2 167cb1f8-f352-7f0d-b827-da5fcce35267
  3 198bf1b9-6310-1a3e-b10f-a1a296c33223
  4 5da1ae2c-71dc-2d4a-80b1-cf44c23361b7
  5 ea9b0d34-5a76-0a66-b1c7-e19b28b176ac
  6 828a298e-4650-6857-8997-3c6b6e73950a
  7 d03fcba4-4de3-16c0-ad64-1d306cb6c570
  8 296bd22f-917c-6b09-83f7-a0d3b4eabb27
  9 da3df060-80cc-682a-b20d-f184625b0743
 10 6dec4915-6e80-4627-a9ba-4b6e341139e5
 11 9566a58f-86f4-30c9-bcfa-4b352f0e0b9d
 12 ae6699c4-b360-0a3f-81bc-166715217c44
 13 822f5d3f-6ef9-6e67-bb08-c0db50e3da1a
 14 fcc1bb7b-65b8-3360-a064-8362e0a5c6b3
 15 a48c57b1-12a7-774b-9b10-734897b3ec31

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 671206166430637. Exactly this sequence comes out of new Random(467).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 38 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related