201208170525 yc7gn

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 74

Metadata

Post ID: yc7gn
Title: 201208170525 → 2012-08-17 05:25 on A858's clock
Posted (UTC): 2012-08-16 20:25:12
Timezone: UTC+9 · title 05:25 against posted 20:25 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170525) = 6c69818d855647dcae9d0331d3fc3560 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(74).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 50 · predicted N = 15 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1A2A123DD4DFB596 1D684D3D867D0D81 7DD51B6570D01C25 B8BC308C84929C6A 920259B92F791890 6D3AB8FE707D8A0F 45D804B3CCC290A6 29FF41DE14CAA3E0 1F6B6E48C2F4AC3A D597489DD484FA78 0E482DBD9FF89028 28729C2590820547 28181EA0CB91E969 0D610071F0B22B94 904FEC6BF64EA585 1CD8DDC157BA377C 79B0527A08DE4BA7 E7640F0C00544101 3C0837216038A51D 31A453A35F0FEAEB BEF9DE057153B0D5 7FC3D910A7BB1EC3 ED11D224F46E65DD 66C1E7B5AF1F8634 79EEF825F2AEDDDF 8494DF3B7161A22A 17E20F9C03FDAD79 6EB3AF85A1DA16BF 33E1BAC600472372 53B9AFF04AB73DE7 BA03B7F641206E41 CB5067044C1A2793 986AFB33B84D8B12 1C8BB5BC7C07D582 416602967F28919C C5FEA27F9B47FE67 CE951389C280B569 5A3537226CF1E8C6 AB9B2070A804EBA0 37E3486A119B6887 847D6E2C1D0EE51C 00DC9BBF45BBCDD9 1EB259CB1D965D8C 80A4BDE3F91D5DC2 70FF9E9E57EEB060 51858A0F3DB045FA 32716B624EB571D2 C2E8C296F826546B 7256BEC3F22234A3 3A2543940423801A DCCD93904D8272EF 2FEE889FD59CA4FD 3C148E36FC9F5A17 68192994F32DF571 A7DCC3366ED16382 E2F4EB4993C25AB7 16EB470500CFA7DB D8E3E42393DA4439 D3677DB90C6A5B61 69744D5403138670 AD290FB49062969C

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170525 (name+title). Key = MD5(password) = 6c69818d855647dcae9d0331d3fc3560, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 decde0f5-4c68-3e00-ae0c-b65e7e3236e4
  2 0ff34e19-b4b9-4f7f-8d0c-573943555269
  3 4d7b3729-b2dd-423f-9a77-78577291b987
  4 c73b6e18-18f3-330d-af16-0d0737654dbe
  5 1abbb021-ece2-54ff-881f-fd4a5a3c038b
  6 7960dddc-4fc6-2155-9c24-ae609dfcd5a6
  7 ed0b6e3e-3801-0fa7-ae12-77d56f8c16be
  8 5eb04d0d-d202-5884-bc52-4c96c54f37d5
  9 0c1f1eed-466d-1890-9d6b-fdf0febccc80
 10 4b0a9e42-119a-5b4d-9fe2-8d13ec045885
 11 35effee1-def5-7e97-9f2f-2c6bf71de2ea
 12 a3abb59b-2689-2b64-bf50-4a07f3fe8273
 13 5b69a6e7-9acd-4eda-befd-e545ed488ae1
 14 e7b19138-bc58-8b09-8946-55710187fb8c
 15 5a984991-50cb-75a9-9093-74fca3c9ae3a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 344352051572487. Exactly this sequence comes out of new Random(74).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 50 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related