201208151120 y9umv

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 452

Metadata

Post ID: y9umv
Title: 201208151120 → 2012-08-15 11:20 on A858's clock
Posted (UTC): 2012-08-15 18:20:08
Timezone: UTC−7 · title 11:20 against posted 18:20 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208151120) = 7507b3e3a4b8c96ad337d42f23f61393 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(452).Next(9) ✓ verified
Run: Run 23 (seed 21,083,000) (seed)
Draw: 4 · predicted N = 11 ✓
Machine boot: 2012-08-15 12:23–12:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B6B5198405C69E37 47E819A82C03962E F504840E2DB53119 DC1AD02E3161C987 8FD0BD107615EC6C 9F20A97C23826A9E 46B7642C4AF4CB8E 2E57C947776EDDFB 259BB47E35A82258 8CFC2C3E5A320EC2 6BC2DB36FFD16AC6 D6E59A813F38AA51 18C235F4BA46DB97 60C11D3A8CCBA5A1 B4A36E7CC9174E29 4F14A77366BE64BA 01A76DFE7C6E80D3 E3F8094AB7440E09 02D06E39A27B1C3F 400F5BB0B216CB0F C9A870DABF3D5AC6 A110BC42484FDEB7 E3C49CDF39B8EEDD 2E5541DF98C662F0 4EED39E6CF57E4F9 AAA93DE4CF458C19 90FBA8870022EB69 01D95D67A07CA693 7263E8E0EFA1463C B3D78D17ECA0117F 6FADA96EE8490F71 EAA3A04ED7DB0F14 8FE0A224C84C9F91 3B121E3950422C48 E0162AA97F1819ED 627145737D7532F5 0ACBB00BFD19378C 276EB96087EC319D DCBF17AB022574BD E7ACA015FDCE7780 BE7DA22911627301 41E075A8305812B3 2FC444431A796C26 5A40655846F01BBA 95518452F1F0A0F9

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208151120 (name+title). Key = MD5(password) = 7507b3e3a4b8c96ad337d42f23f61393, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c1c1832c-2df1-75c2-9b92-3446230c0ce7
  2 12375b8c-f3be-38c9-9dff-fa8e0efb8aa6
  3 fad97118-e09b-6010-a87a-7da2c6a2c335
  4 1d1960f4-ae5f-0dd6-a6c1-35610cbd7142
  5 f61b3a74-7af6-2662-a3d5-92f08679b351
  6 7b1b1964-a38e-5f97-b948-f01b4acf6fb5
  7 36214e8e-a787-3fa1-a373-44a8b4b8933b
  8 4da12f81-4106-131a-9882-2dcdc42adbd2
  9 85120db8-99b1-8bff-9ab2-6a6c09fc4025
 10 dda5a913-09cc-8718-94f1-7625889f0b27
 11 acbf58b9-183d-2428-827d-75144ef451ee

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 73602531882. Exactly this sequence comes out of new Random(452).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 23 (seed 21,083,000): new Random(21083000), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 12:23–12:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related