201208170306 yby2d

explained decrypted filler

3DES(name+title) ECB, 14 GUIDs, seed 23

Metadata

Post ID: yby2d
Title: 201208170306 → 2012-08-17 03:06 on A858's clock
Posted (UTC): 2012-08-16 18:06:02
Timezone: UTC+9 · title 03:06 against posted 18:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 912 hex characters · 456 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170306) = d3e4399c96f0a4ca3fdc3ded31c96c46 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 14
Filler GUID seed: new Random(23).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 4 · predicted N = 14 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

135171EF9C2C187E 39C01E287437A90E EF280B60518A53FB 6C301D834B88DB45 2DBB206665974734 5A31D2060F2F7ABD 320253C9D095EA4E 25DA8824F717637F BF3A5888D005C5A4 320EE9FCFB8B681F F7FB904C78D16484 086A17D65CF18259 B2A26635AF742A31 A339E26E709A7984 F0E65FEA4F2C72D7 C49CB156F3C35758 B9A30250DDB11A70 B393C621E17D093D 3EDA7EBD6536B9AA 22466C3EFC51FB42 6DD4E77C5ECCD3B2 13DEEE74D2276B0A 82EA7253032B0984 AC795C4DC231C6C3 E41F2D45BD704817 A9C7603CBEA5C86F 39F9EF250F91CFF0 6E69A95CA8DE0CF8 75277F36796DCF4F 4523AC44A3412754 1F3EF041A239EFDE 376E7BA465646E17 D6502EE3CC24A3D1 FCD578A4CFE12222 06A75C634BDFEEBE B2E5D8B696E0627E 3D061EEF6AB2731F 7AD5F2AEE3CD7E76 C75EC7A6CF82344F E095035F50600B1D D625E7BDE1D9318E 0DB6E3AE5CD52BF7 F4A64F782AC0FA20 485B8239B5A1F811 88A008DCF8087FFA FB68A775CDF6637D CC9E8C7B465C4B6B E29BF1C968718C58 BABF39ED71824EF2 8F97A116562BFB0F A35676F0D5D807C1 FA9182EC89CC9A7B 86B933CAFA8463C2 9D80DA95AB79C3E9 8CE8236F0939632E EC48951F30190A87 C2FB5B0684234684

Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170306 (name+title). Key = MD5(password) = d3e4399c96f0a4ca3fdc3ded31c96c46, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 45a6c231-b757-6682-b07d-72aafd222d66
  2 fc350d15-70d3-5943-9856-1912f01e3140
  3 767cf460-5e5f-7f20-894a-335e8fe6fa6c
  4 9b8bdcad-3a48-40b2-9403-7db99d61f90e
  5 c0a4c907-138f-521e-b1c2-04ecd345240e
  6 bf832a35-80ef-5fda-b59f-ce6c2f147759
  7 56876ba8-090a-1e65-ac45-479c61fd5f75
  8 196a566e-8e24-83f6-8897-4c5707b064c3
  9 19c6ffbc-d632-7482-a6e5-55189b766483
 10 cc0b5569-1d6a-6f69-a580-e715abbfd63b
 11 ece61b35-d5df-2f92-b43c-758a7f39238c
 12 0828e3ce-220a-34e2-9951-b9690c346ad9
 13 77bb852f-e480-3022-b167-ae5cf2e493ba
 14 73f05641-d1ea-39c5-88a4-c980a731c1fc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 65745518762333. Exactly this sequence comes out of new Random(23).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 4 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related