201208170324 ybz8y

explained decrypted filler

3DES(name+title) ECB, 24 GUIDs, seed 831

Metadata

Post ID: ybz8y
Title: 201208170324 → 2012-08-17 03:24 on A858's clock
Posted (UTC): 2012-08-16 18:24:07
Timezone: UTC+9 · title 03:24 against posted 18:24 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170324) = cc9bd765189d0cc82b204e9b99b73d81 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 24
Filler GUID seed: new Random(831).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 10 · predicted N = 24 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3E3DAFDF85E1EE11 38FBEAF68F35D89B 1E45BC4FDA209C53 3FDC8850573561CD AC8E6666F9E4A520 32A949DA5A3AAF10 A5F1BEDC00AA3260 19B97105DB7F22B6 7C5C0B2C8EA2FA09 4CB928AFE5C75619 C9E3F22D374E6309 98DA81C01FFC12A7 70FDC3B8A834CA88 5911E26663D02FD3 E62DD779DC461277 9F75F9E9C5BB0D34 650E370A6B0C04B4 1222763654B14841 7D1EC31310EB476F 03DCA637D4541D54 DF1D6D894B1DAAE4 B25327FBC5115989 4E3A5EA703FC20D5 47ACC18BCC35197B C3705C5B7BA7CB67 42C4D1EFF9C233A0 1613C59443DD5DB2 4100CAEB18FD1FF9 017155BE2C6666AD 7B81F0D388B9F2C4 1BCBB1EE58DFBEA8 8CE08DB8CAC35917 70EB92D2DF08C2BA C4540862629D3416 974586047697040E 5B52E171C86F8D65 97D0EF4238EA35B9 26CFD733BE8E7527 CD8DAC9B926B0A72 7E16614F294CD87A 8A915B3C22FF9C46 D0DD3BD175C362CF AC991B4F944BBC17 CAE085E129DDEB47 9499696E190385DF 920CD10F46A792DD 35E39892CCC1356F F742335D5715E883 FBD81A44D1FCACA1 6DD3B8B23CE5D1F6 AA732920745333CE 69A75D39766FD90D EB615F17EB9BBDC9 220D7F31283B12D8 BB11C01954B5E230 269B64D61A835FE2 0E56FBDDA693126D E6517733ACC1D028 3773A57FCEF99203 E30B8C64567029FF FDAFCE858DF74B14 072834AC861D4882 51D0886DDA0BAF3E 513711D7CF4BF4DF 6583A4DDFB402C90 6C037B2629D6967F 6EF66D91894BE7E7 B5E5104B973187FE DE9A365068653E10 BCA6458A6F46D4CB 4AF39B07B166FDC5 513545201CDDB97B 674D575A1803B949 A59A52A65557DCFB B64429D9DFDDF24D 065BB67C001977B3 EA947FAAB48D0C31 1E4840B717477742 179AC10EE23E0431 C2807B7B1ECD763B C63745EED7242BC3 27C3724328C139F2 685BBD4AD74685E3 3C157CAE31D604C3 EBC0CDE11BE62C89 C0E530EEA18BB63B 64664B5B9FC03E10 D3F8AA24192A3057 279CD1A0386717D7 B9340FEE7CD26D90 EE56BA8F380A7528 779A8889BB4680F7 54BDADB380357540 8E04FDAB28667DA0 83D7F3F8953D60C7 6A32D7A54630670A 480D228780753DED

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170324 (name+title). Key = MD5(password) = cc9bd765189d0cc82b204e9b99b73d81, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ff666526-d2d4-706d-a0d3-a3bb3d31905a
  2 15d5f621-fe94-5b93-832d-d542de974a40
  3 d5ca8280-d41e-50d2-9f05-b3f9ab51be2e
  4 875fcca6-bdff-8a86-904a-d9324e86b283
  5 93392b0b-342e-3868-8cdb-b9ac513531c4
  6 77e7e184-4f5c-6f08-87ad-6de9c21d8172
  7 ee8e4fe5-2d37-241d-911b-f472e9cb9042
  8 11a9b78e-d973-3635-9824-d92dcdd80c7f
  9 e50d3030-0507-79f8-b06f-21709bbb30f3
 10 bb796c91-5183-6369-96b4-466e6a75357e
 11 a4ab768b-4f48-4683-93de-dfc378a7d548
 12 09e5eda3-6c9c-2973-a90c-0c2b5a97999e
 13 a1b7bbb3-c007-874d-9f53-29062a17b6e1
 14 cf711e85-5696-73ac-9b1e-495501558cc8
 15 2b43ed35-5e54-5e9a-87bf-8e2e50e8f48d
 16 1f40be6e-003b-08a0-aec9-1dd18483806a
 17 23bc721d-f965-160f-9617-412d63998290
 18 eee1f8e2-70b2-1097-9107-d1f0bcfc5cdf
 19 b31da362-50ab-12a0-a0a0-40773af5881e
 20 49017fa3-8b54-0036-92b0-d8e495e5f67e
 21 2aa02a3c-67cd-2e98-90ae-fe8b8f58b6c4
 22 13fd865b-28d9-66ef-bcc1-3ecb39c45aa8
 23 c2b36455-611c-390f-8f8d-f7eae79f0ca3
 24 882af93d-bac5-346d-9722-093eabfd09c0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 755836237642875011102633. Exactly this sequence comes out of new Random(831).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 10 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related