201208170427 yc3m8

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 268

Metadata

Post ID: yc3m8
Title: 201208170427 → 2012-08-17 04:27 on A858's clock
Posted (UTC): 2012-08-16 19:27:46
Timezone: UTC+9 · title 04:27 against posted 19:27 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170427) = 8dd08704ddfbb86e4886e90a9c56a73a (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(268).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 31 · predicted N = 22 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C1862D872C1D73AA 64E5D74FD32655FB C0E31992E99170DD B9C7EF89147ECA9E 37031E0B3CDDA9CD A75B76DF83EF26A3 F7D73BA0076B6A43 6029CE4778225AAB 8FB7767341A4FE61 F71D69056CBDA8A2 07D30FFEBBA238C4 206590F200844934 FC385CC8C6FE5C65 8F49C6A3A81515C0 92CF5CDD03EFCD14 80AC584FEEADDAEC 20D5D82B306E5F53 0B6DAE972731838F E5D698E01E723B5A 0C38727D9BE82A5D F897CBE2E6412C68 DFE8023274B6490E 363BEDAD368C0787 C64CC09CDA531551 F008434D4E58E94D C15AC63095005587 9787FB0E77690DA9 CAC5701A343364BD 17DFF5194566927B 93D24FC3D3ECC648 800769A110AC2BB3 118038DB188CE429 486FBF6CEE2F191C 1FFCCAAA0A44B8B0 68E60D27AED65D2D 55CF4FB8DC58A4FE 143DCA3E59FF8897 957122AE9E893BD2 153C70C27A670778 3D058CF053388669 86663B4979F1994A 56A4A982A4252C5B C89213FA3B00BC8A CBD39F1506973DCE 9CD1E1578D2CCE64 251B722423A1AF6F F1E66BA0EDC4EE13 057E1E612B665E14 94493E9846295007 C5579B51E8E261D6 3C7079C33F6A2157 AFB05A769D49D0E6 CDA145E3610CF562 A9AB04CC779A853D 98247C676183031F 2294C7412F3003EC FB4F0382951C664A 881306CAD267D026 C00C78BB8F7E65EE 8E47AF26F4C419B9 44ACFF1B313FFE8E B7946DAC627A4295 89867F2A2CFE675A C28D5236D1A5CC58 8F1CA4C337159B34 4EEC5D8BD1ABB82F 8317FA510D6DD990 327E4D94575F216D 9B2ECB6BFBE1FAB7 241B8346C764A027 14B13110160E3CA8 0305498FA7D44C33 906156AE9489EE2A 834979D27ECDA36A 6E6D3CA98742C0DA 4F90F37F4F093E52 E3BBAAE5B1FE5929 540F2EA4D8646E08 23AC11C888A07945 E64AFC8A4E179F08 BC2CCAC6AFE51E13 844F1FE6B509D09A 55DF1A8720921427 9D76EB33C36006AF 6A50B9B407C930C1 04E85960AA6C53D4 33EBA4F577D90002 C8D318B92C1EB432 7737CC253279BC06

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170427 (name+title). Key = MD5(password) = 8dd08704ddfbb86e4886e90a9c56a73a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e281032b-0489-63c0-84a8-1ffc52c72b43
  2 c2c170b2-481c-4120-8953-cc5f9d7ffa95
  3 6b9b40f8-4a6f-0035-810c-31caed53f2ba
  4 4e377813-50fd-6f00-b3b1-4228aea646dc
  5 3573549e-4264-18ba-b46b-d9913abe25c5
  6 09a50eae-8783-6166-be2b-85ad25b282cd
  7 3007b3ad-63b6-88e7-a4df-74b3fc140d0d
  8 8929c8eb-09f9-8899-a98a-29294853593a
  9 5aa4e0d0-5ba7-1a9e-aa0a-acc73d624294
 10 81f94400-2b32-0cc1-ad09-22dcd56db6dd
 11 bb003173-e553-6037-b015-89420a2ab55f
 12 13db81a4-a92c-609b-b3ad-74188ed842a1
 13 e8fc9f26-ed36-7356-959b-c978ed2eaf56
 14 62336b76-4d4b-8046-a0bd-33b0f75752f6
 15 f1f879b4-679a-5c1b-b2ed-27443f8abb39
 16 2c66633c-107a-3526-b45c-73be6cf165b5
 17 6a3f7232-2777-405d-82c5-3b6c2567b36c
 18 392c28c4-c2c8-1eb0-9ba0-18c5475b883b
 19 b2415b4c-29ff-8a50-b2c8-f7dc33218985
 20 fa99f888-8c71-0c9b-8dcf-1a28dedd0740
 21 a6f0e4f9-509f-3468-8c9e-b5b565b7f08a
 22 bfbf9e4a-8475-5cf2-afa4-4220a0881976

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6406168810667853418035. Exactly this sequence comes out of new Random(268).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 31 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related