201208170345 yc0po

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 261

Metadata

Post ID: yc0po
Title: 201208170345 → 2012-08-17 03:45 on A858's clock
Posted (UTC): 2012-08-16 18:45:15
Timezone: UTC+9 · title 03:45 against posted 18:45 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170345) = e88e7b1955bcbbd5886e84d633b6b398 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(261).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 17 · predicted N = 15 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

040DF12088BCB941 461D849E7FC9BD2D 2BEF1EADC921EC2E E00A3C360D360ABF 449613CCB91C9F68 EEB5448B6F332A8D 94D94985516ADEA0 F5F9F0DD805CB3F4 C8C31514CCA087A8 094EF891A74C9DF7 67241A8436465935 1F779214328D06EA C64ED6E5F2A8B11D D72512E712D0CF85 BF9B76B725A14F97 BB829259E566ABD7 C9AEA613C155E40F 15856CA711EB5583 6A1D003CD5457038 61B86FDF445FA45D F35460B0BE50C821 BC6B5783ABD696A4 CCB8A2D6AF898612 1C8566E473F700FB FCB70EC40EC26038 C58CE791ED743E24 A919F032A3904A77 463E807B8C641EEA 3AC589CECBAB45A5 58D44F007C3D71AB 22E434B951FE3D46 BA4616F7A5D586C8 9DA93D7B9C059DD1 6345E1C892DAC4C2 E98991B224DEEB07 6CB63D7A59CCE8AD 375695FCF9E88CFD 0435478EF8AA0671 F1F9A0AD0EBBD1C1 30457F362F395FA2 C4C6CDA0D9ED4F0A 9B8DF399376A2DDC 57A98F97BCF1591A 50ABCA955BDD2667 7050EE44C3945FA0 CD7E2127BDE9A6A9 7B0A3A6EDD8BA7C1 4F36F2FC93068E2E DE45E185743C1B71 315C1EFB40402444 E2C06FD67BACB31D B116940532E59327 6F57FA76E384494A 7374937EB7B2893F AC2FBD0FF85F1192 25129C56ACD613FE CF33D3B7D9B97A6D 7375566717D0014C 79048F26CBCBD0C2 C51D90D4AAD62FAF B9C0DA54255BA967

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170345 (name+title). Key = MD5(password) = e88e7b1955bcbbd5886e84d633b6b398, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 401ac3ab-0fd4-0153-9f90-61b1985afb14
  2 99cb8f7c-6650-3d21-9e0a-a8f65f639195
  3 9eb276b0-ba35-112c-8724-4234d2053946
  4 02c46261-bd90-23b2-94f9-02edb767345a
  5 db417ec1-a07c-08e1-ab3c-52bacb63f302
  6 0ffc028c-d620-5392-8fa7-6a5d12c053b6
  7 7cd1baa7-de2c-7fd7-b932-df23d4f9a038
  8 69d2a949-a610-34b0-b69a-7d3ad63832f6
  9 362c509c-1cf7-207e-a061-9cfa86040f11
 10 5569c7e7-fa12-4853-8129-c53dd6fb4381
 11 4128c51e-cfd4-57f7-940b-ac4eba4c8dfc
 12 a37ed3ba-9d69-24bb-ad56-6b160d7d5881
 13 aeb48f4f-5e02-06a3-82f2-a1ded607baf8
 14 36d6eb12-be83-2379-8d8c-109b851ef543
 15 743485e5-2ef3-688d-8c05-c182ee335e4f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 031205732452026. Exactly this sequence comes out of new Random(261).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 17 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related