201208170439 yc4fm

explained decrypted filler

3DES(name+title) ECB, 11 GUIDs, seed 614

Metadata

Post ID: yc4fm
Title: 201208170439 → 2012-08-17 04:39 on A858's clock
Posted (UTC): 2012-08-16 19:39:50
Timezone: UTC+9 · title 04:39 against posted 19:39 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 720 hex characters · 360 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170439) = bdfee121d106570e64f41b815a01e11c (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 11
Filler GUID seed: new Random(614).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 35 · predicted N = 11 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

08E495C62ACE5040 FF7E9B54A13B5C1B 0AA2E2BD49F6C343 E3FA07D725B2B0BE 68C9DA2C1E522F89 93F0C17D36C22804 E56CB09B53550055 C5E432A03EDDFCB3 CAA641DA2DEEF016 F50EDFBADEB48CD9 084FC931D01E8E15 F538A4A0E6884457 A076DF37B2C79104 8EB12392D3F548A3 2CF0B1991D00C058 8E1ABEDA04071CFB 44B8F6C30C6D687B 3A9CE8811CE1BEEA 6583593AA8E6B5F0 528307A6C3551042 FA9D1023726AD13C 5A772C9EDBAD28C6 46C545941374CC8C EB85A539489395DE 3B8E2ADD15B74C48 7E1399796724A6CD F6E65E0EBCD9C094 0FAEDAC9E2AECA65 C8CD703FE7110E42 92F609064AB4956C 44EA611101B591CF 8C8FF10D0C97E999 D1BE9353A1EDFA9C E2EBA77E4C72AF10 9D0EA13DD6A1508C 9DE6B9C094B73820 522B7D713316EDF1 3122B0AE1EB46622 BE098931A0E2E73C 0BC9F772669C0802 27FD2912E2C724E3 464ABF8189682C04 E7A0D1EC36DCAF91 7C2AAA8E01ADA889 D5887062C8C28C8B

Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170439 (name+title). Key = MD5(password) = bdfee121d106570e64f41b815a01e11c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b178be1d-2af9-4ec8-8d11-1fef0ca985c3
  2 2d1b7886-69ac-8f16-9617-10a0fe70f91a
  3 e03c0de4-eebd-8c48-8c26-b95232565263
  4 e418b8b5-7faa-5bce-a315-2e6500ce3e00
  5 d0bf99fd-f1f3-391c-b672-8edf546185e9
  6 f6f0b17e-432c-19a5-af5c-53ade12e7ea6
  7 a4a3ffe7-e418-026d-a77c-82c176d0e32b
  8 0a339f28-c845-4195-84d3-25338648ed4e
  9 eaf6b687-30c2-8c9e-80da-864a5946e3d8
 10 43ed670b-fd71-6b70-a199-3b3bcf14cf28
 11 ee1dc8b6-1c43-5229-a6c1-4d7980fd9d26

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 48853104865. Exactly this sequence comes out of new Random(614).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 35 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 11; the post has N = 11 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related