201208170406 yc260

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 559

Metadata

Post ID: yc260
Title: 201208170406 → 2012-08-17 04:06 on A858's clock
Posted (UTC): 2012-08-16 19:06:26
Timezone: UTC+9 · title 04:06 against posted 19:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170406) = e33655dc749daa88df2d2214f7da797d (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(559).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 24 · predicted N = 8 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

04E5BAED4D520578 F117C90A1E48BE59 D83CD09722C92993 41708F4DE29ECE05 8F5097B599C12014 201346CB4C3AB699 824A95D0F31F1B62 862B814F6F747F62 52456A29A9ECC458 678D8DC1753A827C C5F1D298AE180C37 C500C5ADB7F94CC0 CC85ED7CC63453D0 A47D1DF95D556844 42EA3D9A1EE1204B 03C296B9EC08B7DD 0EDD571DD90F81E1 71CA0F7358C577B2 531BE4B94F9FFB4E 9C21D1E9E072D0F3 995A8AC9C33110BA AF84ABF22BA612FD 7D68F52DC57FFDE1 3A2157373F355589 CACFCE1E1773B254 8658CAE330720A92 3B361835B63DD4A7 BAC26BAF1B1F55E1 1E3EAC9DCF4E3537 ED97ED474A957DF2 BE5FCB6CC779826F 67976BE4EEB240CC E6CAFE7B84DCD8C3

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170406 (name+title). Key = MD5(password) = e33655dc749daa88df2d2214f7da797d, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7593111c-b9d2-67e4-b9ff-10250321b934
  2 c09d2404-4128-79f9-9814-a3729cf0a256
  3 717d26c0-e483-456c-b14c-a748148c80d9
  4 c99074f5-aba9-7dc8-b137-6535e0ba7cbe
  5 dfcb9e4d-0ac1-5c05-b53a-d368508baebd
  6 6fb1277e-ed7d-0d4a-80a6-ddc29988900c
  7 bbdbc0cf-dfe7-38b2-8cc8-62bf0f714a6f
  8 3055fa31-3fc0-7b8f-aded-26595b9db1fd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 67475037. Exactly this sequence comes out of new Random(559).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 24 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related