201208131900 y4zdy

explained decrypted filler

3DES(name+name) ECB, 9 GUIDs, seed 873

Metadata

Post ID: y4zdy
Title: 201208131900 → 2012-08-13 19:00 on A858's clock
Posted (UTC): 2012-08-13 09:57:28
Timezone: UTC+9 · title 19:00 against posted 09:57 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(873).Next(9) ✓ verified
Run: Run 22 (seed 528,385,484) (seed)
Draw: 80 · predicted N = 9 ✓
Machine boot: 2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 12 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

B3D4C51E742BA322 D31483A68E40258F D7D34148A16EA6B1 5AF1968DAD9E9BC4 0588ED85D7A843CB B2B6EA84B45742A8 3F1F12C6070EDFF8 1AB9308573B701BA 69979DFBEF0CDAD4 F6EC1CCEF5CD7329 91A6F5E27AF1945A DAFBA4814FAE2A6A D431D1C013F56950 2A6DE0BF29AFDD06 6A6C64F8A79F14CA B5B699FA65AF7B5C 9942DBC73D215400 53658B0304B22457 127238C4AFEE924B 47F9F56AD0C5BEBF 119DBD29B50FD934 45132A27614F41EE CB7B92B2FEF8E131 2D3734A822A12469 B0097068D9B4BC18 AD3EC9F5A6ADEFD6 696AB5E931699FBE 5AE597EE238E4793 FFDBEA7C61EF6AD5 4FC33C8DA043E3C2 5B13DF3F948AA47A AF3F1670B01A28B6 261C7847E90EC1CC 00F19BFD3C22B11E 88BE7DBCAFDB695A 54265E9D17B2A123 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c26c6f2b-306b-77a7-9072-7335bdc58c34
  2 7892f6e5-9f60-846c-af5d-281cb824ea85
  3 4538572f-efe1-85a0-8244-0737178fb29e
  4 47ec34df-0ffc-8750-a423-c804118d4916
  5 ea341756-5576-3f98-b76c-ca63d0108b19
  6 a698930d-53cf-4eae-9818-e861d9062e63
  7 41bb9983-7234-05f7-8800-b6bfc15d85c2
  8 fd958da0-6f0c-3d07-aac1-9cf1e518d54a
  9 5df07b8d-dcfc-82fa-9d7e-408cafc69b2a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 788834038. Exactly this sequence comes out of new Random(873).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 80 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related