201208170433 yc41x

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 58

Metadata

Post ID: yc41x
Title: 201208170433 → 2012-08-17 04:33 on A858's clock
Posted (UTC): 2012-08-16 19:33:47
Timezone: UTC+9 · title 04:33 against posted 19:33 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170433) = 5c84e139519997763ac9529d85ead4b9 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(58).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 33 · predicted N = 8 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

789FD704BBF7A7F2 45C48B0D690C0BE8 975D2BEFAC47AAD1 907DD8072F4DB51B FF6167176B698696 4D5F2C54C8212EB6 284EC30D18FF29C3 817AE1AC3E972C57 51AA20681FECDC10 EAC7BC543F55A119 2637D192638691E2 0C7381020BE3FB9B 7C0CC7FD71119EFA F819C62BFE241F7E F528A03AAC497E04 F36AEA3672A01DA2 B34B27376B27BD9C DD7D222DB92D1C5D 70AD3F5E54141B0E 57950ED81B15F5AF 29C7B639267EA426 81CAB202F7E360DF 0D4A410423D409B1 03742A06F6390303 6253A483FACCB9BD ADC5153FE89DE302 9515BE2C19CCB5C3 0FC2684A1F51AE5C 8BA9A81ABF91A69E FF97FEEC68CF12CB 52567C00100B5BA0 9C5484DB3D6A18A2 10D9BCB5BC435C96

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170433 (name+title). Key = MD5(password) = 5c84e139519997763ac9529d85ead4b9, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 256c77b5-7ea9-0343-94cc-050005262b8a
  2 82018a61-6e5f-7d1c-90eb-58ac741dd924
  3 eb64c3a1-9efc-2c8f-b267-95ebc7ae07fa
  4 9fe98fdf-0817-894a-a78d-34876e941f9e
  5 35ef152c-7296-33d4-9c9a-f1117e4e5129
  6 5191c106-9348-2f96-93e5-119a28703e27
  7 11aa7691-a257-8e71-ae36-69f925017300
  8 58973795-058a-4c87-85e7-5ec3dbfd1038

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 07283284. Exactly this sequence comes out of new Random(58).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 33 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related