201208140340 y5nt9

explained decrypted manual

Operator test: 29 GUIDs, seed 331. 3DES, key MD5(name+name).

Metadata

Post ID: y5nt9
Title: 201208140340 → 2012-08-14 03:40 on A858's clock
Posted (UTC): 2012-08-13 18:37:33
Timezone: UTC+9 · title 03:40 against posted 18:37 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,872 hex characters · 936 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs: 29
Filler GUID seed: new Random(331).Next(9) ✓ verified
Run: aug13-15-triples (test)
Draw
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: name+namerun: test

From the post to its content

As posted (encrypted)

204B34EB9F495838 EC64B52B9039B221 09314B35EC09A53A A805D872E1A7B465 3618ADE49AFA0C5A 45925BCC33BBB888 84081FB4C21A4CA9 29E418482472ED1B 723B3AF8820B31FF 757933D7EBA233C0 FBE55829549A5C16 E9B480CEA4503F90 2D311DA76EB76CC0 5798829F8E2CB141 10C24E6E73371EB2 8CF38F446628C377 B5C560F7DD88FE2F 8764C808D48ADF42 425ECEB62FBC1A43 6701A9D58C05054F 3B2C553D4CBA9C8C B14A959FA497BB22 2C21032001B55BCB C94E83B98FDD43A7 41298E61E97DEE9F BCF78538C7AE2FE4 CC334A83E19A7838 195EDB3704FD3493 2A898E41FC916ECB C2E8E1A5B8862A7C 7ED2567ACA2B1A3F D3FB29246B764AEA 5B5ABB9D7804101B AFFE09B0830032AB 0C80B4C9AB3054EB 93962993C06F38FA C591ACE96B9FE023 4DF5C982A7468CBB D593DA1DFAEAB518 B806E72F37347792 BE5E2C496381AD29 A0763D0ED405FEB1 0745E365AADF2591 29A5537450B4A031 4AE8FE31046CA1C1 C3413D23984CCAD2 08321D03E7F61CE3 C8E88D771343D406 D235C385A21CD9B9 BB9B43620F9C36F2 8DAE3CBA87CBE79D B0AC453D09AB71AA DB178647DDB58B73 F4069906D74AFEBB 7BC9ADD0F6C5EED5 C25A4119D4D7739E 316DCA2A8DBD2088 48725DAE59FEA122 12B5CFF0DC5AFBAC F2E58A9BB682F20D 949924519621759E C1EA857BFB17F3DB 117EF4C4AC681005 819BC6343D04B536 7AC184573B0CF1DB 8304F832D7F02C19 4F8E13E2D0EDB3C3 ADBA25B701929C89 0951DBA89ADD97BA 6A464E72D32C946A E638A2FEF92D9DA9 938AAEF9D71BA886 D1BF67FA5274170B 04E982627F5F3C65 C4A6B6A88FDC8847 F845AE5629C8F646 285F5145EE23D4EA CF856A23441B6513 F52A3BFEF13433D6 53E10A304AD38EDB 5DA5E31FA41E862F E200CBD119134E4C 91CE2E79C82B1DD4 AB5AAF2B84DF83F2 2698E8E356E77AF4 FC6A5DE2EA3EBE6C C85085DFD2998661 FC4B3AD66C30ABF4 343C87ABC48BD026 3712D3F321123413 D4894BF2C2B81AB3 C741970350DC1F49 91CD698E2321C78A A74ADC2DD64F002D 0071785EF0E5757D F38E1ABFD5D5731B 573431ACB9CC51B7 A16DA6673CF6864F 86FAE69DB92F59E2 AB492C41864B0327 76B7F727B7B26B61 5B30051DB46A62BA B7FEB8A2F6F3E897 65AA28FB3A0C51F7 7D62C9449AB15A90 F14487F51FF0D2CE E91359FB3BE90964 37C02B3FE92940E2 7B64FB2D016A83DC F9B7C9B240C6FCD1 F3016E926CFE1945 CEE90F1EB5CFF6E3 D33E190162120C56 4F2EAE514CE3FF9B 622E1D1485680A62 163077602990EA79 12ECFFDF2899BD4C

Read the ciphertext. Strip whitespace: 1,872 hex characters = 936 bytes = 117 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 29 GUIDs as hex (shown below).

Decrypted: GUID list

  1 27ac6cd9-22c3-5b66-8fab-d87e6e632b20
  2 ab9a322d-c348-835e-b951-96fd91828665
  3 4fbd9738-2b46-151c-a2e6-2dd487cd0b2b
  4 8e37dae0-d8e2-198d-a9ec-b78cdd2664a2
  5 4a4cd4e7-d999-5024-9633-a1205f58ccde
  6 96c013c2-49ff-7477-96e5-53a8246b2c6c
  7 e7701373-4315-18be-9bcd-681ded7cfc8c
  8 d306ad57-1657-4b32-9dd5-2d620a25c943
  9 42e1a9a0-4d7f-8001-ac73-67bb4b3d7daa
 10 254e1990-ce10-2bb1-aa6c-3a2c1f1022d0
 11 369f713c-171f-1438-9068-a3a76c712858
 12 dd007a07-2ec5-7828-a9a5-ee54987edc88
 13 4e2211ca-863b-1042-860b-72fef96d14a6
 14 3a40821c-ba52-6551-9f04-b42ad2a54e11
 15 8cc49e22-7eea-669f-ad94-c05f4704d369
 16 3a55eff1-ea4b-6d27-ae78-3ff213434d95
 17 06063ba9-61f9-06ad-ae27-2e767da702dd
 18 0dfb3bb5-c191-161b-879a-440401b6e663
 19 05f56c08-071f-510e-ba5b-4ef61df0f366
 20 ee711799-5578-4ee7-ab9b-fb3aef11800b
 21 421bfd7a-d526-75a0-8233-a456ed857f71
 22 2a0d6f06-d3a5-0b86-949a-b1481ffe02e4
 23 1bf86320-9d94-8def-acb0-67d41a37f5a3
 24 03555f71-6a2c-5136-b249-2ae4299b63ef
 25 1db0a1bc-206e-13c0-9fac-db9ddfc40924
 26 294b12ff-e45f-3069-81d0-0b15f351d31e
 27 42994574-308f-477b-aeb2-124be77f531e
 28 728634e2-3dee-7383-90e1-6970bd69ccc5
 29 61a5e987-a2bf-8713-992f-1bf0e1e8ff7e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 58115714821716660154708513478. Exactly this sequence comes out of new Random(331).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. Grouped in aug13-15-triples: three 3-post bursts 1 min apart with title zones +9 / +4.5 / -4 around the 2012-08-13/14 machine/clock change (clock lead +150 s -> -1 s between them): operator setting tests
Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method: MD5(name+name) ECB
Result: 3DES(name+name) ECB, 29 GUIDs, seed 331
Explanation: Pre-cutover filler under MD5(name+name) ECB: three 3-post bursts 1 min apart with title zones +9 / +4.5 / -4 around the 2012-08-13/14 machine/clock change (clock lead +150 s -> -1 s between them): operator setting tests; list seed 331 from the GUID masks (3DES(name+name) ECB, 29 GUIDs, seed 331)

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Solution summary

Related