201208170506 yc6b5

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 794

Metadata

Post ID: yc6b5
Title: 201208170506 → 2012-08-17 05:06 on A858's clock
Posted (UTC): 2012-08-16 20:06:58
Timezone: UTC+9 · title 05:06 against posted 20:06 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170506) = 060a0b02a792dce5bedfc4defdf1c1de (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(794).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 44 · predicted N = 21 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

976C001915A4CF38 A2D55E39304CB9AF B845F661B9F86A05 6781A6C69674E1C8 51725F6591BDE327 176546D0CE6EAE0E A977FE0F112AC41A A924615C04165C48 030B7DF98D2F6FEF AFC31233C0C0DADD 9DF229B75614B3C3 114295BDA9EB4468 BA51500E0886525E FA0DEF50F234F195 24EA551496A8C701 BF9976FB32786B9A 75613375C970D25B 075F7860E36701AB 6126FDA55D8417DC B0A3EE596E0E152E D1BE1AC4DD42DF32 8738D503FF7EE2B6 BB4185ACDE7BA51F 30153A12B921509B 7CB1AD8009B060C3 F0A64E8E2F458C81 8A9814895993017A 591AA424F48A6704 030826A40220195B 85AAE14D5184A6BC 0AE78C723B676BEA 21BA92B3A9E2B064 ADA696B266261910 94CC6C88D97651A7 67364E1AAF840C8F 9792AF2CCF19040F B99FDDE24EC24391 97EAADBD594AC06F 6FF284CB4989D3DC 372B10994DDCE79E 1D8F72FCAD9D067B 82F371398ECCB94F 4C736150E156EA65 893D5D116658EB2B 439E0464F8316A79 BDAC535E77934195 0196306B0D1F5371 7D88B9E4F9E2AA30 D9DFAD01FEAB5E6B 7B04CE011E93E455 0CA363D0A10BE184 FDCC3EFEC207EAE0 44BBCB1D8C67C404 CC929AE293633D2F 14759CB3BBD71681 1415F1A84D948398 AEBBA434F6230001 7997FF636EF3CA56 6411E77A96DD4BEB 36E775E0A43BD851 E1C64E6B277CF34B 85E85BA4255C36AA A3926FABE9DEA6D0 3A5646DD6D0F93BA AA15B6C3377506F2 21D747EF3DBDA181 ED05DA1C803E8D05 5860621E8917A282 88BEF9B0B6AA3FD7 4531E8A7EDABF924 A0F29172F79DB998 77F1E13A50699566 B560F89ED443DED4 8CBD61A8280AE238 6A67EC1B9C6F7BCD 542761F214051228 F9C3109D4EE1B8A3 EA39AA590479E5C2 141461E52B624B9A 0461DFFF192D9808 BDBCE4F7A146C7B6 3E63B0D98887129B 94DD2E9B2F6103F3 5671040556AF997C C26606AB26EF5FA5

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170506 (name+title). Key = MD5(password) = 060a0b02a792dce5bedfc4defdf1c1de, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d414ab9c-49c7-4b03-a13b-1c671a211f39
  2 5f65d592-e184-7db5-a8fe-0355e220b778
  3 b611acc5-3abe-6545-a970-b4af711a41f1
  4 d2871795-600c-0db5-b8f6-fe3a62f6d71f
  5 dc1a431e-0db0-6e15-bdf1-ca6c3a49d10f
  6 236e5f12-ab8e-35e4-8c26-e52a563ded19
  7 c33ae72f-57c5-51aa-85ac-f6c79f670552
  8 4fee1cdc-657d-7ce5-92f9-a540fc6cbf3f
  9 833f4e3c-750d-1dbf-afe4-7cf1e180589b
 10 b80684c2-e68d-014b-8f36-f2a5573bb775
 11 2eb52cd4-f98a-2690-b4c4-b98bd72bd0c9
 12 af6663b5-4bd9-365c-81fe-5076f6818d82
 13 2c3894a2-f77c-4486-98f1-3107458f9957
 14 b2ded2c7-c27b-40aa-8120-06cdfbaad113
 15 d4f2f766-2f22-6244-98b5-17677fed90ac
 16 62fd6c65-d023-88c5-94da-1f606fefb5d7
 17 8921ac07-d16a-560f-9899-6dd4257aab8a
 18 fb17d829-5e44-292b-ad38-42b077db6a60
 19 85ca7cdd-11ef-1a81-a59d-02f1dc5a27f5
 20 043ba546-0c94-6d4c-a087-8870c5b74b8b
 21 700dbbd9-7af8-25f6-8260-56a9334ff1cd

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 476063571023446852162. Exactly this sequence comes out of new Random(794).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 44 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related