201208170513 yc6q9

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 605

Metadata

Post ID: yc6q9
Title: 201208170513 → 2012-08-17 05:13 on A858's clock
Posted (UTC): 2012-08-16 20:13:02
Timezone: UTC+9 · title 05:13 against posted 20:13 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170513) = 4a67ab2000144b32b01093b17d2efc0e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(605).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 46 · predicted N = 13 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D0B63681A0825B20 F6390A4C4F520A27 D2A08C6B78DAC7BB F567300A37904536 0663DE4EE51344BA 569002772A9A18C6 ECF8CF008F1192E9 5B9B0CE2ED3613DD 5C516268D6E9DEAE C4A9BF54E0EBC9E7 3AE2A624D2B6B4D6 21573E50F2D8EE6E 40FB26EF889825CA 769246358F546EE3 9A13C7CADDAF5D94 5B5DECAC89AC8D8A 92CA49BABE44D483 89348BABBF00DFAF F369B8C07B772203 14B3B6759F368C1D 354F364454354C2C 112306F4B9C69230 CD98B6BBB3CEF48A 439121EB3F110DDD C9F623F0F7468916 1BB912A9264B2096 FD9375E053BF881A 1A4143B878997A09 C4D4026C0048ED78 32FA53E585E36E47 2CB958206538736B 9D528ECBD6BC287F 0EFA38D3AAEB7FDB EE4B2CFA44F78AE8 6622C52AD7203E27 933BE8737D4A7FEB 5EE12EBFEF7A971E E075B3847076431F 9BC0B3D9CD8EE8D9 259D995EDAD3AA31 EFE3DEA76042FF0D 16E5CCECAF1961AB AED8951F5840E09E 718B2EA0D5E13BF8 8B8C7819CB5044C2 E38ABC97B3F3C815 9ECDA20E9D044364 652DCE714386BEAF 36138342DF685BEF 337958126ECD4394 33CFFA8257937985 3DAFEE83AF96E5BB 047932266BA9450E

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170513 (name+title). Key = MD5(password) = 4a67ab2000144b32b01093b17d2efc0e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5e8b16e1-8cd4-747b-8188-eb45bdc1f164
  2 78d622cb-2a88-3c85-a01e-174e5310c5e7
  3 926af742-660c-5382-8e66-52ebd30ed07a
  4 eabf20af-66e1-6534-9ea5-930600d64d57
  5 1d7629ad-1fd0-3b20-a1db-f01c66702d2a
  6 216a4fb4-6a4c-2440-afe1-65af1785446f
  7 077b6e0a-10d2-8a48-b982-d15ce8658574
  8 199bae7a-5f89-809f-8618-da3c758eb594
  9 6a192dfc-e12d-7d92-91c4-0ec7ad8c8cc2
 10 33f38784-4e23-36fd-b3ff-0a85f7f78c08
 11 7293356e-7769-0b28-8267-c905f87d877c
 12 f8df76bc-5de2-72a8-a974-103ea132eff2
 13 43f3c949-7e52-4393-9759-0b368c9d4d27

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7356328873074. Exactly this sequence comes out of new Random(605).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 46 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related