201208170714 ycdzo

explained decrypted filler

3DES(name+title) ECB, 24 GUIDs, seed 8

Metadata

Post ID: ycdzo
Title: 201208170714 → 2012-08-17 07:14 on A858's clock
Posted (UTC): 2012-08-16 22:14:09
Timezone: UTC+9 · title 07:14 against posted 22:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170714) = 496b1ebef68282bb6526d6016cc88d77 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 24
Filler GUID seed: new Random(8).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 86 · predicted N = 24 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9D31D919F8B07B95 CA82FD9B73DC5BC3 F41ED8843D17CBBE EC0A61975446A082 24EDA6C7E8A817E2 002CF5C6505E0929 3E0BCA6FD442C1A3 D1BC009EBF7C1BC8 32C3358ADBF37BBB C2E92081301C72D4 429175F181824A53 49A71229C66E4949 130D95462FAC9237 FA476AD7E0D63B33 37346E2EAC3524BF 6B8C37CA7D934F6E 714D6BC4630DCEB8 8B8966E803A1BBE8 AB86B8A179502453 A2AC6EA8CA1E8CD6 43135EDEFBBDB57A F3ED933214DA19AB 7AB2885F5C8F6BF6 BF333C92EC99DDCE 46BB72A89EB0E429 A2953F4D73F31ACA 82B229C36A2FAB9F 8BF120829EDC831F D764EA123BC96EDF F2898A20AEE694EC AD512086B08AB026 3FA2A21C69B648AD A379AC895BD47DE1 1D63B0EDCB3D20F1 03F2184534C7E62F 2B34B6E9BA0216D1 9EDFF702A36D6BC5 309C6456B200FB8E FF1CB5C216EFB242 F104A01B88B7B8EE 87410D11DFC4B1EF 8A539232BBDD5006 A1090F53F5A183C8 AA100452FB88ADD8 E32804DE2D9FAE73 CEC3327043D28FC7 AFA4793209CBDD54 A6FD8E52F3AC944A 184005751043E5E3 54CEE7845112F2D3 A3F2FC61DA5BAB03 A42D423313E81F9F 9704C0D52326B46E 6263D0B54FC64606 5A59F01534505BD0 118555C806B5C6E6 BE60AFB79A4037C1 41D9715433EB003C D7501525D7C1C5E0 B4E6111C230925F5 8F812E367C08DAA2 47464A0F63D83D6D C2AC2222FCD3BB77 F0E2AC39A83465DB 491ADBF031C54124 97335BB6AE69B6E2 C29DD9886593E283 29DED55045A6B6F3 9CBAD1179BCCA572 EB82F71BC05EABD1 1F6D0C586FFCFE39 1852871CF1DAF788 E7F7ACD275D2ED20 8113B4FC3580B831 4E67FF27CEF19CFF 8C25671D46F34A6F 61F51A139D1C3991 4D8D2C045D9EA1F9 C2B23794510CA088 922B32ECA0199C05 0533331A6626861F E4326799D81913DD 6C02D622DCA37A7A 1F07BA2D6690BABA 12C1168C1F5ADEB5 C5E6725D2B00D99B 6AC0DDF08F9A20BB CD5B4771B6768F1B 73CD3F61EFD8B4B3 F3AAAD9B232CA6D3 866456C4A884D4C1 EBE5634631C26C20 27B1D625089DBFB0 4109082BBBB9E842 83B15355A2FAC165 7F7E0054A42E7403 FDEC752E63F49046

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170714 (name+title). Key = MD5(password) = 496b1ebef68282bb6526d6016cc88d77, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3e4f7aa7-ecd5-8f5c-8bf1-040d8bfede8b
  2 04c22105-1f81-1672-bf52-1e1f741e154b
  3 f60191a3-d48b-3e92-aef1-1dd9069e2314
  4 6cd5bd57-255b-23c6-8c52-726870bb88f1
  5 7d54aac7-cf8b-776d-9fac-59d62dee40c8
  6 abed0821-e430-47d8-95d8-02528cdd5e71
  7 51dcb2a4-82fd-4711-bcde-bf51c01f4501
  8 03f5454f-1ad4-4009-9d28-47cb24582bc9
  9 d5110850-5a7b-8028-abeb-a795f3a90e11
 10 d2f374d5-14c7-2ed0-bb88-d45f77b85985
 11 8756d338-5685-132f-9046-cc709f7185a0
 12 83f77b1a-1a50-6fb4-bcaa-988f654f6d3f
 13 3ceaab5e-7956-1160-8d33-af5ceffe7efb
 14 ffc860bd-1fc2-5448-98b4-e69871fb275e
 15 3b374552-3d7e-5b07-b293-4a6d09b7bb67
 16 d857765e-cea3-06f2-829b-ea5533931e2b
 17 6b36620a-bb8b-266a-888d-23acf9b8dffc
 18 5e80701b-867c-88c7-99f9-f728778ac6da
 19 4909c1dc-6884-8acf-8597-b623516104ee
 20 717f376d-3492-3eac-9d2b-fd016268837e
 21 23f3cbcc-15ff-7a69-b42b-ba36f9f48fdf
 22 90c26c2d-e08f-7208-a1d9-a17f638cddde
 23 efc183bc-7e73-37bf-b264-e0490680a1f7
 24 8777140b-10b2-7eb1-b6df-84ecb820b9ae

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 813274448216155028837737. Exactly this sequence comes out of new Random(8).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 86 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related