201208170610 yc9xw

explained decrypted filler

3DES(name+title) ECB, 10 GUIDs, seed 638

Metadata

Post ID: yc9xw
Title: 201208170610 → 2012-08-17 06:10 on A858's clock
Posted (UTC): 2012-08-16 21:10:34
Timezone: UTC+9 · title 06:10 against posted 21:10 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 656 hex characters · 328 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170610) = 0a74f4d38f7a2dad6ccee62ed6094b55 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 10
Filler GUID seed: new Random(638).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 65 · predicted N = 10 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

52798B56CA71C480 C926C0490A506CAB 4294ADCC9A4BDA2A 208C0E61E90E7A4A 068F9ACD053DB667 71465ADCC47542FD 1FF8292E96156C07 76B544E46E2E61CF 44C89AA5E9A5FBDB 77F56724D7C7FA08 D76BE00C96E44C32 70A6680B16C4ED4B 0A2E11DAC2CA6972 514F2F6B7C9CFF4C 181BE4B9452E306E 0EA7D3780597142B AB09403F03FDDEF6 C81B0FD27F061DC2 6BFE022A12A86426 0A5B08354906F9E7 A1304E1B5D2BC66E 1E03F9AFEDA5052C DAB5B5F6C0F4AFBC BCE81D0A0575B845 0F6238413ACD0CDC 5B4CE1BBB29C1521 DB3A35535A55AEB1 617D9A9A7E080087 92650D09B555EC9E C126B3FF17B058DD DB99F6232CA35349 41F0134C9829E93A 67930CC8F2CB2E41 7D7B81261F5AAE75 0CB784790DAA4059 E882A8D44FCDD3DC D73C6C5F3B90D750 41A974851E3A3056 2EA6E01F904619F5 05060525711B0925 B0D4794D1A7D4B0B

Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170610 (name+title). Key = MD5(password) = 0a74f4d38f7a2dad6ccee62ed6094b55, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f2c24ee2-3ad9-0778-84b5-b5193055ff76
  2 32f1aaae-0651-0d08-8f2f-d3c0a9b15771
  3 9cc4e7cd-37b8-69b2-8a9a-14cdf5160e61
  4 42e958a4-5d81-6fc0-bf32-7ec43f0befbc
  5 3ef2a244-6fe4-2174-bc59-996454c3fb78
  6 a13c7552-bca5-09ff-8d3e-6b68e1412d66
  7 13596039-d297-603e-b74e-7bc8e48648e7
  8 01fae5bb-97a4-4728-b745-093c647704cd
  9 7fd7c09d-467f-8d97-9663-367c42718fb0
 10 b923bbbc-0c9a-492e-97a1-9ded65c4b9be

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0066206484. Exactly this sequence comes out of new Random(638).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 65 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related