201208170723 ycem3

explained decrypted filler

3DES(name+title) ECB, 18 GUIDs, seed 99

Metadata

Post ID: ycem3
Title: 201208170723 → 2012-08-17 07:23 on A858's clock
Posted (UTC): 2012-08-16 22:23:13
Timezone: UTC+9 · title 07:23 against posted 22:23 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,168 hex characters · 584 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170723) = b1a9bb64b1afebe3b1aa6c389bf434c8 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 18
Filler GUID seed: new Random(99).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 89 · predicted N = 18 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A9B275A317E38D24 4320DE23375621C5 27F8E216FEB2782C 9EA664E4D6FB6294 7561CBCBF3DB6958 6A71E9FA19BF5F21 5D7084158DCABE34 A3307712ABFC5FB9 F54D8CF481493A9B 77258247A0E3188F BD6057C9501382F2 5E63818C541EE0BE 6B872A6E72DE65BA 642602430E6394F1 76E8E37232FB628E 6816234839C79DFF 555B061097F7A32D 393A413C35921479 300CF472099E9E1B F0D752F0DC308105 77614C9D87B0592F 50E03887CAA7766A D16D4E7596AA8BC6 CB05402C24E51DA1 C57FB5266453E152 73DD559EEFA1B9E2 7E8D39D9FAE39CD7 73DC0F909EFD2A67 48EB5CF6DB7F0B6D A432F05D4395DADB 2B210621BF575AA5 989020DFF5C0A1B1 81E7056BD2177847 3C9110810C2D936E D5080B7D77E2BC8F 209240E9F5B1C12C 01E17E3EA15403A1 2AEA004416C34035 47CA98354653DB61 13132940488F08B0 86E9ADEBD2268701 320CA610190B0EFF BBD4F9747CB3E7BA 37A736FA934812F3 AC20A9F23229962E 1EA4D14BD5761B8D BA7314AE67973206 C185CD0A8558939A 54D8C0A769EFE137 A76BC9ABD08CA044 D4D58B9358CCEF1C 558267DE464CE345 A1A4C6E6A4072CA6 ED9778F52D6F6840 68A1DBF72F40FDE4 396A9FBE62BB446E 1C08A26CADD5DD86 14C2EC5ADAB6319D 5DA82921B7BA9FAB 324A2E8D7A307C08 F1E6018CCE95BFCF C02145900ECD1938 BBDCE8B608D6B5E1 344EAA4CFC6982A0 906D2CAE1BB6BE83 4B1A40C44893A997 B900E428046682C1 B9856E991F93FC58 B5557D0F910D89CD D1AEED3CF125503E 17A428CF32B1368C 84C644E775C4E3DA 03D70CAE8A333B54

Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170723 (name+title). Key = MD5(password) = b1a9bb64b1afebe3b1aa6c389bf434c8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4b3fb116-a56a-4a7b-8a4e-2344f9677ce5
  2 12c534ce-3984-7f24-8924-e1962eda4de1
  3 6cb4f6da-a84f-8ac7-ae47-43bfff8eae77
  4 10a93836-9647-60ee-9ee8-be29cac9ac8f
  5 e30b53ee-4b7a-85b4-910e-dffa03425da6
  6 1a9448a3-34ac-0d2a-8837-08178a1636ac
  7 bdba8b5c-319e-2da6-9345-f313b66da318
  8 ae420107-4e2b-0af2-883f-1aa7594fdd99
  9 bb4315b9-45d5-21dc-9e12-f31130480cf0
 10 00587657-979c-7a6e-be43-82fb3b7fc3d2
 11 5cf5051b-95b1-274e-91d4-8257715df0b7
 12 472a2bce-8888-6293-805e-3c757311f1ec
 13 bc979413-6e44-6b23-a64d-e5d09247041a
 14 4ba2f15f-c680-8129-b631-387466509f96
 15 05727b26-c2b2-2d61-a5ae-026811fcbc8e
 16 9754b478-6872-7be2-a10d-75a581491dd4
 17 f318de9a-ed49-473a-bb49-f46ade7bf6a3
 18 7c5fe4fc-61f3-3939-b82c-e3b70886e6ad

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 478680202726682743. Exactly this sequence comes out of new Random(99).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 89 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related