201208170702 ycd8h

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 663

Metadata

Post ID: ycd8h
Title: 201208170702 → 2012-08-17 07:02 on A858's clock
Posted (UTC): 2012-08-16 22:02:04
Timezone: UTC+9 · title 07:02 against posted 22:02 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170702) = 3f55dfa9bcf174a7d570f66819a8008c (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(663).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 82 · predicted N = 17 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DFE4A292B9871633 8ADBA84673250619 8549E099FE9E82C3 4E7E336C9E1DC3B7 7B71CC99E40E3D99 A703752E47A78C84 2051E0FCB86AA5E5 091E9162E7476C7B 49A28D3F1D4156AC E0D4AE1384DC5866 E174F944A6F070B1 4E0753AE217A11BF 77FCE2D740C3F1E5 42356562B822874A B45D1A97D0BD9D50 35D6FAB38DF5CCA9 AE2E686426367CEB E78FBCE0642C4307 D5C2CE7CE400FC0F C6B7BD6198560653 0DF298A27BB0DDA9 7FC570A40D11749D FDBE0CDD323D33C2 B8753077A2CD996A F27EE9C4DF8218FF EADD279AE07FF5FD 2DB035E5A9F05827 BBCE28C87687FBC8 0028A9961A5FC502 7EF9719F5F63AABD 3CFC82C1BABE6E9B 7C740FE14C85F65C E5F9082CA5576B2F 265545D36F195032 3E5D9A7A74C9F6CA 511B2A71505398FD CD8418F4034DD2A7 9F91BDB4A69BAC44 8BE1E6F6FA35814A DD9BD7670BB367CB 91F69FD93A312A45 04733B5FF3BFAE7A 8A610F14D7CF4B7C E1A5B1EF27CBBF7D F4D89527989ABB05 85123B8B2E921047 E56B26FDFCA5CD89 2180DD0173D30694 80AFDB43891547BF FA27C0FD219044AF 6088194EFA0147EB B7BBF88C0368C745 9BEAA6B314C68AD7 61614F6B9552A932 73064A2EE516616C 7E5739A555A5CD64 9D71792B92B78BB4 E454483F61798DB0 AF7D03BF316C354B ECC75692A0B57FD8 E0AD8F73CA718A17 11F31E3EE969FFAF BFBD602D65647614 0899BA2B90373EF9 E3D38E9DA1C2DCE1 E2319FEE1D12A98B 1671D343925DA5FF CE91F2C4B66075A2 D0E880A5FDA04882

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170702 (name+title). Key = MD5(password) = 3f55dfa9bcf174a7d570f66819a8008c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b11e2fdb-5423-05c9-9d93-23c6882297d5
  2 fd562914-29b6-34d2-b9da-0c366c39c4e0
  3 b1b6dcf1-3920-11c8-879e-caf357d6151c
  4 4066870b-23cd-0e84-b5f2-efb4f9c31cb2
  5 d3935611-0575-4c2c-92ad-548f0a3f9570
  6 dabe4ec8-8ce7-8a97-8f78-ce7cff91d9a0
  7 9adebe4c-2ae7-8b9c-a9c6-7c7148278a14
  8 0d62fd91-cccc-0272-9c59-a40ec0092ca8
  9 ec976e29-ba68-05a1-a8c6-c0edbd6bbd41
 10 bf9aa22e-07e3-68e5-a36b-02d5d818c086
 11 84772b14-7e62-6bf9-98bf-943a20cfbb13
 12 0e66703d-a382-0949-a42e-ec80b8d000a6
 13 a27b7349-49e8-3782-b54c-5270e3fb4327
 14 9d9f17ee-612a-358f-ac5a-96259eb342db
 15 23c5d60d-94ad-069a-b0dc-8927fc8a7a8e
 16 de94efa2-774c-0331-b6f9-b8644a05770b
 17 9dad6160-3740-5c08-a092-7e798aa3f5f3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 03104880066033005. Exactly this sequence comes out of new Random(663).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 82 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related