201208170543 yc8hl

explained decrypted filler

3DES(name+title) ECB, 15 GUIDs, seed 486

Metadata

Post ID: yc8hl
Title: 201208170543 → 2012-08-17 05:43 on A858's clock
Posted (UTC): 2012-08-16 20:43:19
Timezone: UTC+9 · title 05:43 against posted 20:43 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 976 hex characters · 488 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170543) = b3309213bfc91c6d0d8e1f664b4b5e2c (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 15
Filler GUID seed: new Random(486).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 56 · predicted N = 15 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5B5DA4B82E1F6004 08C26DBD32FE0D57 46CB2EF82FC777A4 4986FC543C99A005 B1BF323E8C5E6E8E 2B279A959B649AC1 4C15FFCE18A18B42 78399C9D2FB14A4B 6B6BF7AFDEF635B0 2DE8ED1D65EBF8B1 E6C50842F8F48680 6BA393158D43F026 073A508817F50347 64566932D9E997D9 D6AE79CA6AF80401 35621299395BB146 4A51F677BD347304 0F847D2DF42AAF9E 1C697E08ECDD7F9A 7CCAB31E8DE49D2B A12C6CC1B1C33939 2E38687DDF34AF53 99DF2443B9AB6D90 13F158698D1CEC62 508455EA85526999 8FBA0F9C72EFF877 93C199BD82FE3C90 035623BBF2642F68 78A66EAAD218D206 83025B0CB18B737F B4EEB76424079D95 CD1D4A7C77B0F01B 0DF5C28A43228325 B21F8928831F52F9 C583F8D966F929E1 22385F3AF12ADDA1 E76BE56407CAFBC5 A1C760D4323976B1 1AB0592CEE5D696B 1D99F4BBB7196FD2 78586F13684DE8B5 AB76B10D8973950E 3F3FF58C72802C02 413C522FDC48C7E9 F0D025684AE9A135 C588FF8989A67B29 13B8C53ECF360D40 C1FA0D765F065138 075888479C08319E 5679ED4130729E4F C3A0863415FC766E A7A9D873E4A525DD A2DA7CF8AE8DBF04 F92AF60790D79773 D80419FD7C766DCE ED18B1B4B5896445 06EA15E93E2F8CD3 EAE3B0EFDC8E4452 6BC5C2867733F8A7 3621BFFFFFDD948D FD5AC62099106A58

Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170543 (name+title). Key = MD5(password) = b3309213bfc91c6d0d8e1f664b4b5e2c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bdc6c0ea-af79-5661-bdcd-be5ca2b3f4d6
  2 8bb5adab-7146-3615-95fd-cfa7cfe34fa7
  3 ffa884c1-fb61-4c50-9d3f-0759bfcb3cb3
  4 2906a940-a753-2c92-b5fa-bf8537a109d1
  5 66f3c5d6-67d1-5075-89d6-e0de332ab0bd
  6 cbe64885-3c3b-249f-b582-e4c93bbccb06
  7 27d731e2-8155-57e4-8156-7aa460328985
  8 23442ed7-a202-2b7b-b9bf-88c34012a20a
  9 68a5c694-5a7f-00d4-bcb0-b7bca78ccd1c
 10 16cd545e-0129-487d-b89b-09d72d866797
 11 926767f3-3dd9-3601-a6b2-6d019f710835
 12 3d4d5aa6-a31a-8118-933c-4d4dd35e9362
 13 d8bed583-e0cc-6669-b8ef-e532fafab7df
 14 73db832d-824c-2839-9e31-0c04d863f95b
 15 7acbaabc-499b-1ec2-b8d1-22ec0355d275

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 534252520438621. Exactly this sequence comes out of new Random(486).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 56 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related