201208111210 y157m

explained decrypted filler

3DES(name+name) ECB, 14 GUIDs, seed 253

Metadata

Post ID: y157m
Title: 201208111210 → 2012-08-11 12:10 on A858's clock
Posted (UTC): 2012-08-11 03:07:25
Timezone: UTC+9 · title 12:10 against posted 03:07 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(253).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 44 · predicted N = 14 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

3DF17A8B744331F3 2BB892170D2713AD 7F75752325E925F7 47D7333F30AAAB1C F0E637B7949A7B27 0780CD2EF9590647 995CBD960E786012 74E39206D8A3A478 B035B147033F2799 FF8358D2814E23F0 5E8F344D57AB4072 DA95815495C691EB 09C066FAA65F7DD1 A518CE05E6D481EC 2B3450F1787D3D61 12D1BA82A9ABE826 394D00CBF2AEE794 EEB1C970F4ED56C9 75A94C3565F56776 FD53E1ECE10A6A0B ED185545E91BDD09 D98192581A59C53F 4A3EDDCC68E48DF1 992F113E2BB8BF05 A285236D01385BC7 B97CAF26C9AA20B9 2B7581F55614526E 072492F6E04DFF2B 0037BE6C1349C691 5DF0DBC2C89937EB 15A1433ADF73140F F99AFBF97F7DA254 52587EE40BD1E264 1BE0D2A969320FD8 5BEE9066E208640C AE9238BBBF842A38 8BCD7CED60DAA655 C260111ED2604079 0386ED7E1249782D 890A1500B8C3BDDF D5849637AA3964E4 F2E9FEB9419F1C24 A0EE9B082442ED9F C1EEA7BBF6C16C8E CB5D8467E299D5DD 77A97336CAA6A7B0 14477A8B40430A85 CFFCBF6C0CBEBA56 7954D807FF2C8833 23E5E42C8FBE87D0 B6E8223648B194DC 59BCC4ABE209EF53 768F14CB2F6C2D78 0A2AED046801B4ED 0E694960173A8564 52127A364C64318F 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 475667d0-8ddf-8f2e-a0a9-344226f3cd88
  2 598f2c6d-ddd7-0892-bd6f-22f9a3bd66a4
  3 ea3e9628-fc06-583a-8975-d166ced0a2dd
  4 2aa65251-2051-5234-b6e7-e4d08ed57040
  5 34e6c65a-2a11-3bd7-85b5-93c4343e311d
  6 13441372-9020-55c7-a32d-82c0dc42904c
  7 65059b10-4a7a-2ed2-889b-5766bf702b26
  8 6e3c5dca-68d6-382a-bf87-f18718aed336
  9 897436d9-a51a-22e3-a777-566dd191308e
 10 af2f8d51-3075-5e4f-88c6-8d2f1a415046
 11 11faa2e4-8a2d-613d-a43f-c93202a4a7bb
 12 b18dc342-cf91-8af8-a6cb-5d7f1a6e701e
 13 7033c425-9822-514d-a4c4-43019802e893
 14 f55b1910-22d7-063f-9ad8-50b2f20535ca

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 80553523256850. Exactly this sequence comes out of new Random(253).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 44 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related