201208101830 y0qr0

explained decrypted filler

3DES(name+name) ECB, 23 GUIDs, seed 638

Metadata

Post ID: y0qr0
Title: 201208101830 → 2012-08-10 18:30 on A858's clock
Posted (UTC): 2012-08-10 22:27:49
Timezone: UTC−4 · title 18:30 against posted 22:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,488 hex characters · 744 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 23
Filler GUID seed: new Random(638).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 40 · predicted N = 23 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

0A18A338C736EE42 62BE1B2A3555747B 5C1D007D2C312D3D F896482EB990E319 4605CD7B378A019D DD2C159B2E5BE3A9 FEC69C73F6A74897 F28B03EDB5C6A9F9 8B4DD9CA1773802A 4703ECC17A8833E2 3F2186D90B4C90DF D2036E63D4791A15 30D23EAAE2A35261 D26B059BE0C41962 06DF6C817B9164F1 6372C5682372A803 C90C7BCA803C13A7 9034DD1CB25579C0 25F81BBE8BDF65F8 1A0129A0D3024207 F4EC0A3314058B58 D8A8630AD37E5803 95704E81279D5A06 BFB85DD51B6037C0 954C8FA5094F44B0 77C6EBAAB4267F3B 84E136F456E95114 71FEF558D39A730F A8512880541990FA 09478E7F3EDF6AF9 966E388B8D3F388E 7D900952C6492F4F 21CEFC047FA47CF4 C1186BDED39E9C75 EE825BEA75685584 57129D4C5A8B2581 BE5F0321F50F8714 BAECBB51570A850F 505448B88ADC7CD8 69BD4A39F72ED9B9 33240D3D920D757B 983B36A4EA52376B 8FB86670C1DA8231 D5C4163F31CDF6B3 76153C96DBB9CD7A 4783AD44C9B095A9 B19D6DF0A0E64666 3FE431CEA9A3A947 2F2E514B052B0DA7 21C1000B4A49AA2D 08C0DF2150721779 CBDD49FEAE75B96C 7571D29035606BA2 169C4B0B382C01F8 19E2907E8C5DA7C5 38F6E8E638AE97AF D90B3276925D5AEC 79DDB2CB2B1CE502 D6DC8C4E722CD9AE C5E1EDF92162D905 0219CEABC61EE1AB 5633ACFCFC341177 2FA6631C59B7FD8F 5EF49E6FA88128E2 C04AD567A25B2B89 FD3D76F42F3AB7B8 152E2E95D78D240A F2AB2EEE7078EC15 827A500200C84CFA A4FFBB3C0B50F907 1F8A7E943610BF9E D465DCDE651D27EE 69C486247BB04DF8 38C3789BA1EEFDA8 FC931A548F51D372 C4C011ABBB98C294 151BDFC0EAC8E479 0540150A48717FB3 F4F89786DA452F30 6E573FC93E8FAF8C F833E9EDA6E0C159 D053CFA22C2E53CA 10E04860DCEE0230 22E2814778DE99A2 CD8F0677CE85E3E7 1EE8EA66B093F598 488775DB2C1F210F 2BCC0156F584CA19 52032A6C767736F6 F4C92CC775169166 D90CE5A54844C8BA 860C0DFB686E0CFC 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d7827802-5f95-04d4-b6d3-a932499e78f1
  2 e7b0c4f9-dd7d-0a20-839a-8511af229d91
  3 cc345bc9-3d5d-6143-9c7f-367720846dbd
  4 06af47d9-b813-690f-83ca-7f6bdf99bc88
  5 3b861aff-4c9f-2568-b33a-2648f6679063
  6 b3e4e3c3-2db3-0a5f-9e34-59c109d1e86d
  7 36ad10c6-62a9-6f77-9f64-6347aefbd54c
  8 811cd29c-a486-467d-a5ab-de01692f6a7c
  9 33a77908-ad38-8841-87cc-4f5f47f0fc6d
 10 9d307ca7-f26e-4b47-a25a-d21ab22cc3b5
 11 9a3f71fb-2e3d-2285-812f-276a6b2c66f2
 12 f7d1f328-1ccc-5c5d-ba00-888878059596
 13 1a597084-3daa-2b67-9f98-c04fa7ec8be3
 14 3fd99838-1fe1-3a17-a9b3-9577397c45a1
 15 e03df979-e114-5beb-8a91-1b28726c3ed8
 16 c157efdf-d021-4f9c-b7ee-d2f000dcdf4f
 17 55fafdc3-3ff3-0f65-adb1-3d3577aefb79
 18 05b295d8-ffaf-4c42-9356-e1be85501546
 19 6da767e8-efbd-8767-a60c-17835a954e8d
 20 175faac0-f880-3920-a2e3-f4e408d550e5
 21 fef1e203-213e-56d6-b6e5-fbea86f719b6
 22 26fc0e83-7184-30be-bdf6-b2b5b215e4e5
 23 b945995b-d604-77c9-9a1d-96c14c5cbbd0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 00662064842523540483537. Exactly this sequence comes out of new Random(638).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 40 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related