201208170336 yc03i

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 741

Metadata

Post ID: yc03i
Title: 201208170336 → 2012-08-17 03:36 on A858's clock
Posted (UTC): 2012-08-16 18:36:11
Timezone: UTC+9 · title 03:36 against posted 18:36 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170336) = 88005136a4ef7a6449ce47e9a29fa6b2 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(741).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 14 · predicted N = 15 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

41534C7A9403D954 377CCB38AF137BE9 64468585801ECBD8 33E3E91BD02EE644 2FB7CB7A0F58D543 84F8EAB56DE59F4C 82C840281453A7F3 FE7191564C7B284D 1F4F802D1379F298 9ED400A34CB32BA3 30A7199B8987E18E 31653A4F550D1296 AEDAC801E05A4A7A BE6550A42D6618E3 C4BD289984564D96 A2464A0376AD8A98 4A79D473274F3CD5 AB8C2B384F88C5A0 EF6BBCBF7F569264 8F4B6946516A1FB0 5AD8E482C0ADA033 992864800E49286B E5BAE09D01C9CA31 BBF382B8A35410FA 26B0ECEAC29712DD AE8E6CAC1CF23054 72190482FF93CF45 913B6CFE82424D80 2A079A5D2E709F24 143CC08EAA8BEDB8 958DBCAB4D5934A7 E0A9100546F7F1FC D0FEC55E555C33B2 8BB28C4BEC2A1ED3 0C595E196059F2D6 B0A7FC8C549957F7 C1FBBB26439B6334 BB2BBE429D8C7599 F436373D103A9523 C9C2D5818CC47479 E37A682A4FC0E3B6 EB7335E5899D011C FC61ADA625FDB1A4 5664012197733A4C 57A939FDF968B1BE 73BD21528B0454DB 8930CF004D66DC69 140A4BF4FB715FE6 232F5430F383B77D 52CB0BF0921C47C1 A19B30243689BE7A 045AE0BC0121F17C F139AB9423376A03 11D05BF32410C7E4 DB2F6B06A876E4BA 86B493EC4E5168AB AA08FA847CA5B781 0CB669D8CEE047EE 4E6437D8002DBB2D 7FA3053E88895E79 17163E33474ACA08

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170336 (name+title). Key = MD5(password) = 88005136a4ef7a6449ce47e9a29fa6b2, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 17337ccd-199f-7313-addc-9b54987212da
  2 f8dc6ea3-2255-26bf-a571-cf16344b7300
  3 040afb24-ac41-6012-8be4-9b5a5b0d9d8d
  4 c6c3522b-3f96-65d2-be0e-10accc981f35
  5 d3cd5279-bc84-6216-85fd-980a7f562a3e
  6 6b38fc9d-33e8-1740-a06c-fff6c4956b14
  7 b3849d33-d597-8afa-87c5-39e2798d9c82
  8 83b38585-79e3-1783-82fc-93975460c8aa
  9 e70a1d04-5784-52ce-850a-d9e355f8c125
 10 fa283887-63d9-40b8-89a0-150485b2197f
 11 cce81757-acd5-1de1-83e0-199e2113bd47
 12 63e19791-c8c0-80ad-82ba-92f9956f7a8f
 13 976996e9-3e1f-0fc8-91b4-3d200eca60c1
 14 6d150926-04a6-84ae-ae7a-0d000d040505
 15 bfc8eecc-e3c4-5859-95b1-3af787718bfe

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 726661815418085. Exactly this sequence comes out of new Random(741).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 14 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related