201208170503 yc632

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 702

Metadata

Post ID: yc632
Title: 201208170503 → 2012-08-17 05:03 on A858's clock
Posted (UTC): 2012-08-16 20:03:57
Timezone: UTC+9 · title 05:03 against posted 20:03 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170503) = 529b3e5e4d9aeb645ad5a78545900105 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(702).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 43 · predicted N = 10 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

0BE04F6206689513 6388F0F9DF164D66 AED9A39599B40525 1A9F39FB017EFD2E C50CE744C4509934 46D7F1B225D85FF9 7FB10A52C4116B73 F7661C360C0AB9FD FA4C8E0753DC3821 A49585043FD8E052 F6D01C39F3F0AAD1 F25C18255D17181A A7EE8795098D28F3 DBA6A607C34D4AC3 989D0819189F128D CAE490F83ACD793F F792DD6DFBBAA7B2 B93FC55D1A8CB2D4 E96C0DE681F807E1 5CA3EA9436D5A703 1790D102A38FDA14 E3FC64E55E9AA89D 5E9A602FA7C49F79 3333723F153C80C1 29A911E065A15B77 3F1CCD9928B39648 30F64BDE4AB4EB04 9545212A85046C8E BE9997600A043EF9 45008D5F1A67EE35 680885184DC18690 2F3893DA874FFFF2 D130088628E99548 874FD2BF596082BC EA557B2689F4D29D E699D54A6BF0B82C 4787D426A4F22012 CB6D231437173AFD AA11A44695F9C76E 67F2325696C13940 32D7E9A03FF04F04

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170503 (name+title). Key = MD5(password) = 529b3e5e4d9aeb645ad5a78545900105, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7b473a72-7b38-4ae1-9b00-7398d903cd46
  2 72999340-ed87-73f1-bc1e-1a09a5247b2d
  3 35907455-75e5-4921-855c-f574a8492e56
  4 9088e404-34c3-307e-a3d5-998ac7c30904
  5 cf5831cc-f18e-11ca-9c0a-4b7aed4581fd
  6 e94f3d15-0e27-0610-995c-5bf625a32f8b
  7 97d0ab39-4957-37d1-8db9-9283583ba17a
  8 0bd7dbde-9888-50df-9636-f6163b39b001
  9 6f92693c-816f-709f-bdeb-51054e71e02b
 10 183e0214-99b4-1f7f-b8f4-7168d2dc7545

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4743103571. Exactly this sequence comes out of new Random(702).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 43 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related