201208170552 yc8yh

explained decrypted filler

3DES(name+title) ECB, 20 GUIDs, seed 796

Metadata

Post ID: yc8yh
Title: 201208170552 → 2012-08-17 05:52 on A858's clock
Posted (UTC): 2012-08-16 20:52:25
Timezone: UTC+9 · title 05:52 against posted 20:52 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170552) = d1f11a52459bbfed74ea2a7b81677b79 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 20
Filler GUID seed: new Random(796).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 59 · predicted N = 20 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3BBB72BB93C0312D B8194FABF456BFD9 DA7327E68A8C431B 14BE1FFB9F1761F2 B0A0C24DE6F0E3D7 0237AC724EB411C6 EC8CC14011497E2F EB857C91DADD2B3F 621F8AD8E36CC6DA DAABA23E7B80E6BF E318162603B513C7 D5B1E0A6F872F393 F7FE76F8E80980D2 4B00A69DC5D7E7E4 B0184A51B09CBC9E AA23683BFB7D09A3 538D11AAF00A2544 DD510CC0D79ACE1C 2927BBFA61EEBB01 E00208897E71DE7E 806C425DBD8D9545 95AF65C0048E21E0 5377B5FC4332E682 7A0964680891F6ED C65F6B4B3FCA9910 8CABBED61BA2F075 E2CFB54CD429A57F FEC079F98AA182DC 27A4DE892ECF06B0 741A37F061B9F35B C299936A3F8CA49C 8A7918A495CB16E5 E2835D7E862C8C81 3C8C5C2D6085B66E 5CA6908A57B0D4A0 279E36ECE4A2A9E7 B1787324F876C004 57A3E11FCE94FB51 2293ADA0E7B7EE92 8F86A062DF350F66 2BFAD16F8DDDB280 92F217BF3AE1B2D2 106AA19F249542A2 D272B50D0B888D5B 926A83AC48986BFE 4D3F2F2D2A808825 B5FB8871AC9FB4EB AF0DF9683B70E6ED 942F15959ABD8A34 485D1392D78F4F99 E58318E85E2D7AC6 10160D41C380D794 E9FB5BE9BCDE0B3C 43BF3D6B9C17F66E E6959854AD89525B F9A815E82C2DF349 72385A07C6E341D9 0C2BA11DE19A07FE 401B6553015D48ED 5A6DE1BF005DDAEF D1F63110C62C06FA F4651B5035BA0016 15662CA3227078E3 89F6A4C2181E3451 2FBCAF9C352E370B 5491BB1D05871E95 0245B33449D7A1D7 B5ED782A2A125BE8 076DE957652DF2A1 0B91DDA7BD6C7ADD AD8F461CC6394335 93F05EA38D9AE11C 947801C9D24BE61F 5F5DCD41645C04C8 73CF4FCAFB56F068 3D83E9BE0B8D59FF 401E0FAC3CDACB11 3844CADD9A7D9D59 34CF53D291EE774A 999FD8EBB6402B41 E2C5F91515C77F62

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170552 (name+title). Key = MD5(password) = d1f11a52459bbfed74ea2a7b81677b79, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 03037570-a3a6-543a-8875-1fb3c8d23006
  2 3c97b063-c76e-3bd4-aaa7-d8a7f73bec3b
  3 c27bbe34-3cab-1170-82d2-d9c2b6e39db5
  4 75e58326-8443-4ffa-b7bd-4c2c02535ee4
  5 2e89f4ac-c5a8-5718-add2-8584f2c755b6
  6 76b0d7a2-e386-1cd3-81c5-006f86bea971
  7 28c7d565-3ec7-513b-bc3e-3f54c94eb00c
  8 85f2f223-d870-77d7-8286-6b85087ea59a
  9 c3255688-d778-475d-9f0d-036a12393256
 10 adaaee68-877f-7514-823e-9b6e0b8d3c3f
 11 c1424b72-862e-629a-8396-bb0870da7094
 12 81dc0728-3e6d-8ee2-a8c1-bf52b672dba3
 13 1c29b610-746c-7ad9-b7f3-d71ed20541d8
 14 bf09f50b-040b-5242-b7be-27f620cc6491
 15 cf525d3a-d85c-1cc5-b022-f4b62dce75ae
 16 6f03e75b-1aae-125c-ab68-c6092324a219
 17 ee6560b1-8e90-4f4e-98d1-b3281d17a385
 18 79f97590-c012-4904-bc14-e028b193f8ef
 19 26aaa1ed-b41b-2fa8-a252-b115a6a9b327
 20 265d325a-c667-486f-acff-41fda03dba37

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 53145157476875114424. Exactly this sequence comes out of new Random(796).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 59 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related