201208170622 ycaod

explained decrypted filler

3DES(name+title) ECB, 12 GUIDs, seed 629

Metadata

Post ID: ycaod
Title: 201208170622 → 2012-08-17 06:22 on A858's clock
Posted (UTC): 2012-08-16 21:22:42
Timezone: UTC+9 · title 06:22 against posted 21:22 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170622) = 5558b1468eb23b1366c5771abfd21585 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 12
Filler GUID seed: new Random(629).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 69 · predicted N = 12 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 1
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

93B23E0E31CB7617 47A0A33D716DE07F 51D1D896D0907B29 F3E3177773813115 C99DD6B3C34AC500 41950AA836CE5872 9B78A3FBE7C08074 FBB079CF1237C6A3 9747071E57A4E342 6435C0D47DBD298F 5B37EE5CC728D8A2 FCBF3772A0B2CB9A 12BBEBCDDFBD98F8 D9A1F22E26B0874F EE39222400B2005C 7465D68129BE9444 A36914232DC8C4CB D646DE835AF3A800 E9B109F5D1B22E46 F1E5A8B770D36B98 D9FA800D69368953 A59EA1FF48103C5D 8EE8C438F94CEEBD AC2CB2415464DD6B 30C65DEC772E83A1 BDEF04DD0FACC135 744C1530F8F40F0B 6813BC28E6C4B2CE 77EF92F8CAF5203C B5A67175947D5C05 F507EE1DD67F86C3 B3CACFBFE54065EF C668EC66B6C0F8DA 27C9FF0FB17986A6 7D70FAE2A4E0B60A 36739965895B4152 A9B53A5202FDE052 03DB72DA3556AA9E B0E6C94FEB1E3F04 0ED0A5DC16C7F16D 39A46A81815A9066 087CEEAFC78FBA90 D4FCEACC9B6EC848 E83C826768B6CF9D 1A41CB98EE05CCD3 A8038504F89E0847 C913C1BCA0678237 C3D03A8741ABB380 A9B8C73044824E57

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170622 (name+title). Key = MD5(password) = 5558b1468eb23b1366c5771abfd21585, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 86ee6e2c-9b4d-21cf-a1cf-0314fe38d2ec
  2 6caf8a64-081a-3a6b-b675-87a925778349
  3 6c5dbfb8-75f7-3a30-a9e7-e4fa9d536d51
  4 6194d555-9215-74d6-bfa7-531b2f7532b8
  5 1612c00e-5bfc-1ba0-95bf-dc282cdb8844
  6 ad65dc79-e2c8-255e-9669-a41d8f915cb5
  7 a52be902-2ea9-6244-aec4-dd88b4cd1664
  8 69cf7115-a650-0385-a2cb-988d4584c027
  9 9d8c6c1f-ef19-7be1-8b7d-9ca85935d62f
 10 73a25ea2-3929-18e1-ba38-7b4233e35444
 11 6062ef65-90d0-6e2c-87ed-772b888cf57a
 12 adecd296-05f5-4e61-b67f-a1f5dbe6bfe2

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 233712607164. Exactly this sequence comes out of new Random(629).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 69 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related