201208131840 y4yud

explained decrypted filler

3DES(name+name) ECB, 15 GUIDs, seed 60

Metadata

Post ID: y4yud
Title: 201208131840 → 2012-08-13 18:40 on A858's clock
Posted (UTC): 2012-08-13 09:37:24
Timezone: UTC+9 · title 18:40 against posted 09:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(60).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 76 · predicted N = 15 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

8CD7CCAAD1CAD30A A03DF0E2669F9FF2 98352492D66DF314 C1E56F2F27B0C47D B32E30BA99097431 474C58BB0458DA3B FB49BCAD387ECC78 884B6CFBDD38A0AA AE2CA632079FC162 40276F4F7D92E338 B7286A3A8AF874BE A29EC2FB6763636A A03C5BA011C8C125 B838575407F4D2E1 63C34C255E566E9A D4B23CD41AF8124E C20D0A3D5A524CB9 C27BD4FCAABECA14 42B4A75D6141584A 4F57BE4720F9F50A D5CEEA8DEBFDB127 F830B74343AD2498 C369D8420869D2B1 63216B0BBD083F34 2808244293B62E18 2D8E6575179F68FA E849CB2C19DFB118 17D8C074987CD507 14215563CB040E89 0DE96A0978104800 E59C63B534E78062 EB822704831BB2E3 24E169C6EE6E920E B30835E915495542 24C8B68EC3E45C1F 97DC1843DF10F223 EFAC8AD15DE72095 6EAE7B6C8A54AE4F 6C1DFE00374F6F25 D2016B73FE033DF5 0554131E28490925 91C6F03F2994BE73 EE40A1BF523B5D63 139704780820AC7F 0CB5CDFA76423989 4DDFBCD6B0A35BEF 8FF0DCB0C5A1CE83 84D76F2E9D54B988 A0A2EF538BF7741B 0A0DBF9036091A8A D8BF2DEABA27C00C 43A4F491CF202322 FE9AA1E676225CD4 248388F088760BD8 D7EED8632BE19C13 74DD26F80E4BB6C8 C1967A478CDF432E EE3119E30AA5F7A6 4467CC8B27D57BDE BB10BF4F91EDE7E8 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1c6df790-156b-021d-8187-00ce5d98b789
  2 4ed7f9f2-e110-37fb-b027-f0c828ba2447
  3 5ce3eddf-13b3-6137-bb64-3526c4bd6eea
  4 c90a87ce-2ba9-38a5-b64b-ddb7532cd791
  5 8de4d6ef-9ce6-23f5-99a7-c0352d7a5c12
  6 35ec7778-3292-80eb-a0c8-3726ef09d912
  7 fe074c8d-2d02-7fb5-b801-16b04a7928a6
  8 68f43fb7-2ee8-4edb-b868-335ba04e6f48
  9 d5bd1ae7-a55b-3b4f-b35e-225c6cbcfca7
 10 224f886c-9917-3db1-b519-32adc27aab19
 11 499b613c-c40a-41f9-b56b-89d75480d911
 12 e427ca32-2c4b-267e-94e2-bfc58376dbad
 13 0be2dcc6-efd8-7d02-9867-92857d1bc241
 14 41c7b8ac-88bc-6d4e-8372-ea5d316f348e
 15 827bba59-298c-8162-af56-f798df6f768d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 036328743342768. Exactly this sequence comes out of new Random(60).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 76 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related