201208112100 y2ma3

explained decrypted filler

3DES(name+name) ECB, 24 GUIDs, seed 79

Metadata

Post ID: y2ma3
Title: 201208112100 → 2012-08-11 21:00 on A858's clock
Posted (UTC): 2012-08-12 00:57:24
Timezone: UTC−4 · title 21:00 against posted 00:57 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 24
Filler GUID seed: new Random(79).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 50 · predicted N = 24 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

E78E951C089B1D98 A2BB607BE34F3836 4E8E3C09ECD21737 B7324C75DF158A18 401B46663F5F3665 D958171B3B56492D A6E82BF120DD4938 1748BF60C082FBDD 1214B44FAEEDC445 A74AD7BC5F564764 2DC8E1F338AC8D3A 3488A30485757528 19167A7830BD5A29 34EC2D6C4F3D5C70 369DC6CE8962125E 7502A031059D0458 4CE60EF02CCCB865 241ABA84813900B6 E7E5CA5657D64459 276822882578723D 2C5EBBCE1FF525DA 3F048FADA4CD636A 9521530609939F43 1D522575A8E79815 9A0392DB2ED9592A 790B2B650E30903A 699B5E53F3414068 E511DB3014D79759 0998F225E93818E2 83EE98BA469DAB90 03C3509F49BCBD1C 43D4C1AB9036F16F 0147E1B0DAEA5BE9 F8619E90B94DB2DB EF98687B3520F283 05243CC11976AB38 8E4175DCE7B61DA2 5AFE18F4A56FE186 90E7768623011631 20DFA98362BEA0DA 75172DD877C85461 7B2BE74EC28C4933 F211D8F3CC997DEB FEDBD8E41A909DDF F8A459890803E153 A43A5A4691128747 069B66682900DC90 3B7C15EB24C94D55 F403CD9BEE19FD4D CA3C81645D1DA848 DD70190CF26624E4 0467DB361DD7CE74 6F47837EAEB6FC45 89414F0E48D7C5AA 4E8F83B082BE4689 054076D591988924 51D57C3331137623 39118C9B24CF8B6F 08F1E39B12FE05D6 268C6811C59ED168 5555B3C92EF927DC 493D1DA45C2C6341 36E805AA8D84B286 0AF115F00269C2C4 E0041A540C7C1D78 8DADF8F9868E6633 E8E9F6F7EC749785 BF63AE1FD8F81731 723F8E5A0F56CA2D F4DA1F772F49014B 53985880471EEFD9 762E6182B1D74378 EECAA31F145B1FA1 75B2E37A24C93B44 E1344345715F8AB1 A03F85910A198C40 518821D6D92FC83D 1036918C4C71A771 DDECE426F5F68327 8C1834038DF867B8 C41A44783F2C783C 7EC84B7FAC28DA8A 1C5C4C5D25DAB883 67354F73B85DE1A9 19478F497FC9DC85 0A6C1AA614DB669D F93F6F5F993310DB 47981C488EB42310 87E4D0329AD90C20 C98C32B29335DA85 B2AA5BC821139C0E 8F97AA876E362281 A13D7CEEE7921CB2 B9155A858E4D29F3 F2BFE5AF86DCE067 E33908813ED8AB58 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8997982e-99e4-8b52-92d2-7b5226174341
  2 cb0de03f-a127-8d6d-87e4-823926717fa8
  3 a5f25482-d9ba-879f-9b35-555df18a6172
  4 ab70df70-c201-3bcf-87c7-d1be50940942
  5 330abdf2-50cc-7630-b6a5-a59f915b4941
  6 cf4aea21-c269-5302-8170-63b8f9d98c73
  7 52d02970-bcb9-2a60-a9ea-540bfa5c3524
  8 9e195cfe-a75a-0aed-aa6d-c8e5a652bfc5
  9 41c81d07-2c0a-6848-b10d-a5569193f487
 10 217ad03a-0898-36e7-ae7b-eb4a075a7b80
 11 d90304c3-4bfd-47ef-a3da-eeafa49450ef
 12 d16a583f-f9b1-1769-b553-e849032d7d74
 13 621e0804-3c7c-816d-9e47-69a80861c558
 14 359497d0-5f6a-5b27-8f85-e58744884e11
 15 815ac75f-55f8-2b9a-a499-e3b534bc867b
 16 8e8b4b82-d449-3ce6-9e8a-3ce73ff3a0c0
 17 25ed58dc-9567-072d-8f52-284bd816364d
 18 646fceba-90d7-8a73-b1c7-75e2bce74f19
 19 dace5a5f-dc90-73b1-b5e6-79b45dc2acbf
 20 d42d2529-edd0-8886-b46a-183f18ce4505
 21 bea376bf-61df-297c-b8a9-243511b95d17
 22 6430deae-f897-29c0-8819-9c32563d97e3
 23 1f475ec2-f8b1-3a33-a11a-716df5f75d34
 24 63eacae8-3402-576c-840b-1c02073e1280

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 888375206341852308782235. Exactly this sequence comes out of new Random(79).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 50 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related