201208170454 yc5fo

explained decrypted filler

3DES(name+title) ECB, 24 GUIDs, seed 76

Metadata

Post ID: yc5fo
Title: 201208170454 → 2012-08-17 04:54 on A858's clock
Posted (UTC): 2012-08-16 19:54:54
Timezone: UTC+9 · title 04:54 against posted 19:54 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170454) = 6b8421a2ebd8fbf58ebb22a9d93f6fdc (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 24
Filler GUID seed: new Random(76).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 40 · predicted N = 24 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

45952036C3807371 AAEFF3F067D790DC 4CE7250F46E44CDA ACEC30FFF603A57A 4D744BB0F14568B4 50F4F7C981584905 EFC354D4D14487D6 7AEB52213B7F0B41 A79CA28A80CC5B1E 76408E766C437C2A 0DDF4DF03D3E2C8D B250D7CF559C59AE 5C8A9717F2FC08F8 40B371CB4EA9EDFD 5125260322636E38 AEB4F79EB8FBC52C 90A5E205A99B273A C272B695F1714CF5 DD830CFB767A3ACC 0EA45BACBB00E632 D5FEA978E1A07B1D 752477FEF6FA67EF C1BB3356A78A0255 B47ADD93030D20B9 83AD63B5BEFFF17D 492BF37F064E747D 1041A9338CF60725 003AE6A27FD4A075 1D8B0FE6FBBA7D6A 7136A23EB2F0CD53 11B16B6A83A7C8C0 A9532180C4066CD0 884EB7372434467E 47797B27728C7EA3 4A6CBDC863FFEBFA 82730DD78D025812 DA39D208492538B7 72CF85E50F8CED6B 854AC33F9389CE34 F97CB31F083D0FA1 FD3557CA0E3F00AA 8C595EEE0101F1ED 5348CC38EEDE48CB A387F3E8EEC3FAB8 8717568BD0280C3F 5704DF6D1856007C 0B9A806A4E162B89 E8FB6CBC0ED6ED99 7796FFAE55464D4B D9789204139B6997 08B26B3D73D946A6 66F1EF0D7269FCCD E9C256CD05C65D67 D4F62E3098018015 C383F07633856236 4652BE8C475D2E17 338154957D6A73BF 604E854F8ACD763C 0A20CCF3594FC34F 0D2588F7463B7EF2 80E7C79469FC5CDB 4424F273612496E9 32A9D82D96A4716B 9A7667E15F0670AD 0ECCB1B96FF7752B F28BAFC22824F743 F9E8A951C3E70E14 600A7C24C332F573 D9B638270FCDFE6F C138EA393E1CA509 C217EF714A737367 20651CB8330815A4 D564EF530501B6C5 ED23372955DD55E5 BC5C7984D68F413F 69674F329F57CDC5 2965AF892425A301 3A794693E45FFE85 C806CBCA77E970EA CB98D64D26E4D252 B4334B9AB335663E 26EBB8B9B8733CED EDB1166AB30CC5A8 4596680FA204C60B 3E8C5CEB598186AE CB81D3283244827E 69663BA7D47B2A4C C79DEF303D35F25B 1FFF61117BA07155 ECFF0F8616EFC455 4724355130DC1142 28B2295B8D2D8D2A 882A6D716F59F62E 3E3D41BBB49DB663 D5C53C86107B76B4 CB4ECD4D8E92EDF8 13F9ECFC02034E74

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170454 (name+title). Key = MD5(password) = 6b8421a2ebd8fbf58ebb22a9d93f6fdc, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 159a764b-677a-39d0-a0b3-3d3c2f0dcdbc
  2 b0996001-d40f-1722-a4d4-402932a08e8a
  3 2e2c627b-265a-84a9-96e4-0eff10b13369
  4 f415bd9b-417a-7665-931e-46e4417714af
  5 9b6797ab-e94d-4516-aa51-85831d2e1280
  6 bf987b59-5948-88dc-877c-890673aaa528
  7 9db80844-e85a-8cef-beb4-8f512608d0f5
  8 94927d25-347f-5f7b-aa72-1b54cdaa46c2
  9 77875629-de6b-3d12-9c07-cc09680b098a
 10 b8a90065-1ea0-25ac-bb4a-a5d49b5650d4
 11 658e82dd-95b9-2c7a-9936-299d1c8aab60
 12 fd351990-d39c-75ca-9519-5b234b51edb5
 13 739911d1-3e64-7def-913b-7ec6080ead5c
 14 f3953805-ee09-0937-81bc-1154c1c4877e
 15 2617daed-c8ce-18f7-a928-a37e947e890a
 16 bc3a65d8-f85f-4e97-a278-0acb6e5028d7
 17 04341a14-8991-7470-b1af-5aef094e62e9
 18 9c711c48-d098-1234-b9c3-2b5ffc6499d1
 19 601105a7-b871-6fc5-9d4c-4da353cc84d1
 20 a720e088-d0f4-6ef4-882b-098eb0e2c32a
 21 96d52f26-8618-835f-b3f7-f8c101108c10
 22 64c8d82b-4ce5-4679-97a5-f8c914ac8a0c
 23 19d3b5bd-7515-76ac-a7e7-505c3bf040b2
 24 b93c51ff-00e0-5351-9745-a07bc7955677

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 318748853227701471668475. Exactly this sequence comes out of new Random(76).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 40 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related