201208170555 yc94d

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 685

Metadata

Post ID: yc94d
Title: 201208170555 → 2012-08-17 05:55 on A858's clock
Posted (UTC): 2012-08-16 20:55:26
Timezone: UTC+9 · title 05:55 against posted 20:55 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170555) = c9c3519080f623a4b808bedcd42537a2 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(685).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 60 · predicted N = 12 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D6B706533FAABEC4 E6CB54B4CC0D0C54 F2C1178884BCFEB2 7889B9AD72E7ECB3 8ADA54FAEE5D0A58 69C09A03CD0A69CA 24500A9A93311A33 D38892645C8B901C 94C2A423FC518FC3 2C04259E9212FA4C 9A7476EB0FFD006C F899A8A68F703058 7872DEAEB02C47FA 3F15A475B47D2F02 E3B07290FDECBB10 3487210B5B2CFDBF 61CCF56FF11491EC 562E86D5F486DB38 10F1159BC4E88182 17DBECC7AB918D5C C71BAAB5887328F7 4DA3E8B8DC505C3B 048B9C1A5CBAA11E 140D9479A1E974A8 5236D0E69AEE8BEC 9F0ACACA3EABE40D 36CEE833486968C0 C0584C7E28A563C9 AFEBA3540239FC37 E3423A15762654FB E80176FCBCBD2673 E5EB8D9A2F98B55E 6AA5B883682F01C3 33FB3699D1F2607C F4261C1A2E3A8043 6F487242D281094B 7D012D2D4233BB9C BDAC79725C2A4BD9 34CB2143214CD85B C95AB3ABCC0D056B 6E9CB175B825F7E9 E3551C5A79019503 20912417B348D41E 09DF042856512473 3190718B044D531B 204901377DED2A7A 524B0CC120A3D720 41E61C95A0A1A6AE 7F4CA9DD82CF2CC7

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170555 (name+title). Key = MD5(password) = c9c3519080f623a4b808bedcd42537a2, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3243c2cd-ef9f-5e8b-8f1d-998e0c4249e6
  2 4a8cacc3-9eff-7338-8214-0d7cc3dc7c66
  3 4bce1ffb-2195-5eac-93ed-5d6f4770693f
  4 19431f34-9d14-66f7-af0f-41c9918027f3
  5 1ebe7587-225f-4eec-9d32-22a65a5cbcde
  6 e4402cc7-77fd-16dd-8310-7777220c5ffc
  7 8d4fdf2f-aa61-77be-ab1c-ffbb289f0d54
  8 8764d1d2-65f0-0806-b57d-8d9a386fa67c
  9 3b4c8d5a-80ae-6470-ad90-e1318e813f9f
 10 5b2444d4-1ff3-76af-ad4d-b15dad1ae46d
 11 ce98792c-966e-8877-a6a6-864c93e6ec1d
 12 a21f7931-2284-20bc-92f8-b1dc3290a473

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 575641706782. Exactly this sequence comes out of new Random(685).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 60 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related