201208170705 ycdf5

explained decrypted filler

3DES(name+title) ECB, 21 GUIDs, seed 347

Metadata

Post ID: ycdf5
Title: 201208170705 → 2012-08-17 07:05 on A858's clock
Posted (UTC): 2012-08-16 22:05:07
Timezone: UTC+9 · title 07:05 against posted 22:05 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,360 hex characters · 680 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170705) = 802bcb2e48be2324f90b81c909e9a4d9 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 21
Filler GUID seed: new Random(347).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 83 · predicted N = 21 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DDE1510B89E4FC58 1FC387D3D6FA5B2A D85E5BF1B51C38DD D14F8DF58CCB3DB0 30850EB77846CDEA EC112B11C80D9DF5 AC256D74529A593F 14AD4FFFA47977FE 32081536B36B4068 B704946720C6BE0F 8FDF93A5103A7334 1BDB406882ACEEFE 6C80D7C8AD5B4453 80A52C1E229535F2 BC14546420ABA600 DAA1F0A5B74DC071 7E5C51A3F70531FE 64F621D666988D67 5AED1287FC5AE861 FB2873B8E82C9174 02A543E49431C2F5 E8F1D95A48A5B931 696CA30A75DB18FD 0258BB4E50527637 1DFB20114E513C81 89A0C80F43BD79C7 37A2A35D51C25CBC 530DF59458999FB9 7DF24C175E85A08C 91D63BD395AC67A1 FB85B476E3E125D5 35357328B48C605C F864F47C5BD256A1 87434D64F5F8BE57 5E4D8D2482BD6114 2FE6A521F8362C3F 9A684A555B18AA04 338C4E24C66247B6 2F8F34A97049BEBB 8B6DB8637C89309E F05ABA0A7457F8D2 B4D6798BD0B3BCA3 7521FD20C2E895A8 55181AEFEC398495 BD0205F91C6B8015 3067DAFC02DCDBF3 DDF07B69AE463100 0F0D91FDD7DFB9A2 6EF6A68316505909 428DD257D78A1500 3A5CDF8FF755BD77 9A3AD05355580D75 9690CFC7EEBC20B5 1030DE04D01018BA 63BB83C06BEBE705 8C7BD5BF1D24CB46 D7CB2E336F8D4A95 11540DF3B9F84E2E 667D3205F8BE8A6F 304DB7494DBEA251 0AF26FB5A5BFA6F2 B52AB663C3529B63 9852A76AB6E05CFE C00B2B27CC7027BF 7BD99E7984B4A3B1 9C38D8F153487427 89531A096302F91A A48C9F3DF33DF5FC AEF0643612A0CCE5 C02A60BAAC0E036C 4FC3C9E93616E32E F34186B8C18BCB11 0CA77EEE3371E687 15CB9C4FD947B45D 3C50239CE66596AE 67E8530F8D5CCBFB 2032B210361F0BB4 D0760F8B8E7B691C D2D190554C5DD163 3774CA88CE53B62A C8E6EACF0B81DA7F 9066FC1ED3F10734 0BBE8D2CE0D47C3B 6528ED732CC6F6BB 0A3000078EF1E03D

Read the ciphertext. Strip whitespace: 1,360 hex characters = 680 bytes = 85 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170705 (name+title). Key = MD5(password) = 802bcb2e48be2324f90b81c909e9a4d9, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 21 GUIDs as hex (shown below).

Decrypted: GUID list

  1 13889e76-9986-0ddd-b928-1854a799fe5a
  2 9d5e4d5b-cdaf-5848-a756-63d5ac58c355
  3 586ad59a-08b5-24ee-9f0e-c2ce1ae5437f
  4 8c0fef72-9454-5254-b4f8-31965849bded
  5 44d46ec8-6408-77e2-8f09-b11df4d9cdae
  6 241c4265-392d-7995-9abb-993fe08892cd
  7 e5959b22-050c-3f70-ae39-85c835908d82
  8 557ff9e1-8a1d-410f-8db7-d74efca58756
  9 02bdd8b4-ecbf-8d21-a688-7d8118cf188d
 10 2d21f55a-bd29-26a8-ad18-4d56d0e5c1df
 11 c5ee71d1-0157-8143-b8f6-64f65086c48d
 12 8ad7ecd0-679d-3b64-a1c3-c6785c38322e
 13 8c5ecdfd-bef8-190f-be84-f6e24a978947
 14 b195c860-0dc2-81e5-84b3-952687359f0f
 15 5faead3f-fa9a-77b4-9a4c-7bd71521d473
 16 02ce3c81-0d42-6497-ba8d-cffe03237d34
 17 5f8a0d60-d48f-6326-af96-b993398558d8
 18 fdf8954b-dff3-16be-839b-6c70daadfc37
 19 f44f9c3a-0f51-0ea4-bd8f-694f9b12211b
 20 a2cefbcf-2063-6e27-9848-e5d2c5582a58
 21 46d1ba51-171b-881d-a793-5bcb645890e0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 052577348283187661068. Exactly this sequence comes out of new Random(347).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 83 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 21; the post has N = 21 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related