201208112120 y2nas

explained decrypted filler

3DES(name+name) ECB, 14 GUIDs, seed 704

Metadata

Post ID: y2nas
Title: 201208112120 → 2012-08-11 21:20 on A858's clock
Posted (UTC): 2012-08-12 01:17:26
Timezone: UTC−4 · title 21:20 against posted 01:17 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(704).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 52 · predicted N = 14 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

446C7B3E8F5245EB 930A0FAD3989FFD5 B819457AC7207ADE 669BFD126EF1784C 901EE0CCBE63195E 03CD838B7D29058B 0AC0750D68B90C1F 59DA8A2F1B7B7F3D 2F346A01C943EB95 DC585D7ABA6A7B03 946E2DBDB8C61C49 72CF35A77639BBC4 93EB243E2E35055F A968DD58EF0F50A9 2E46C02CA201BD0B AD307D50453B629B 95B458A2D520D2D1 CC8BFE3B7E497068 4C5AD04907F579D8 EBCE2101229E9459 F39278151A5655C6 C7A02997DA7461F6 8862427F3926F7E4 1591E92FDCA3542F 589B6D5A14A3913A C7EE4D3ED9C27D73 36DC3DD1F03361DF 40A3CB8749FCA035 6120DBDF7B1CEA23 18FEE6D0AC578230 E6808E28E37C6479 580D0F86D84DD829 049F07DB02E39DDC CFE11E6BB0E09816 9D9CA0EC103BAE9F F0CCB76B91697F94 4E2CDDF8F2187ED7 CB98F2816642A4A1 66EBDEC5FFCEEA7E 4FE0A8C2C1E66B6C 802F531DD00B7DB8 4199E113EB961BAD 97CB2DA4A57A19FB 52291DCB83FA466F 853299E39D831859 2CE9ADA18F744152 A720F5D348573369 3BA1A7DBEB509C1C 312F2C02257C2270 DD043A5C8222C455 681337C5BFDB3A90 3A3BF2E11F24C2D0 955093920D1A5EC4 9BF028436974960A 804AC63D1D56B4A1 CDD650FE7C1154CC 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e26f62a1-a249-40d8-84a7-0f55ead269e4
  2 e8fd7fd3-9458-333d-9fa7-fb870af8bb4c
  3 a417bddb-3f51-7bcf-91fe-3351e1dfd344
  4 76c06f36-e53f-7f8b-aedd-b11e4a112979
  5 2a4bb683-13e6-0b52-854b-9c84f72b05fa
  6 488f6506-483a-7964-b077-7d36edbe05f1
  7 48ddd40c-a3bc-3ec7-bd36-82c93d83f4b3
  8 0de4f9c1-be1e-50a5-b618-077d081fab54
  9 42f1cb39-2517-0606-908f-74f0f44242eb
 10 f129a1bc-cac4-7bc6-9ce5-a0f85246196b
 11 a45cf65d-5f14-8c69-9321-9ab4b595d916
 12 bbbc52b1-6960-0b82-9311-383b12abb27c
 13 6d0ba45d-a38e-59ea-b6e4-171d999674a7
 14 6027a0f2-1664-62df-a9b0-c94890b1c944

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 43770735078056. Exactly this sequence comes out of new Random(704).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 52 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related