201208170744 ycfxp

explained decrypted filler

3DES(name+title) ECB, 13 GUIDs, seed 796

Metadata

Post ID: ycfxp
Title: 201208170744 → 2012-08-17 07:44 on A858's clock
Posted (UTC): 2012-08-16 22:44:19
Timezone: UTC+9 · title 07:44 against posted 22:44 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 848 hex characters · 424 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170744) = e60ee9b3a33fe26383f79fa0255e238e (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 13
Filler GUID seed: new Random(796).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 96 · predicted N = 13 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4149E1279FACE4E6 69273EA8C9CAFCA4 301E955A99FD1516 2BE166DDA9247F27 92C14C5AF4543A76 6C09792CBAAF1B34 1192F479EFF8937A BF8990CA9C664E0A DD2D476E2B3529FC 2C74A97891C3C6F1 49DECA271E063DD4 0C4F3C8D0C968C91 E7C14C584BBDD7D1 87283B029B379B28 FBADBF9A70CBE2E6 55EA2EDC0F9C7E43 200D94D1395695B0 5D649DAC3914AFC7 0AE16D0B32530DF0 8E2F2EADDDC4E066 9F3370782096250B B25FAC88767496B8 F7C41A738F563A79 F1F853DD7561F9DC C8F568C966685A4A 284EFBA178D54F81 46B5308D2E18FB00 41D5EA7A4F1E00C9 738F764FA5BFA573 541A76CA32192FD7 83F2E05FDACC3FBE 98703C4928F90C58 F4179E7A99C23EDF 2AB7303669F9D6F0 C8E7C170CCCC62A1 9A1427AB8EA718C5 AEB8F6312CE488E1 FCCC0CB63063F44B F3ED8949049B7069 ADDD4B84DF0ACCFC 5B40CE6DEFA9553C 9924B99323CBABCF 8955DB05AE71D60F E2236529889AD0E8 E68608BCCA3231A5 059F8EDD428D1861 CD1026E36FDB69F9 F6157C969996F5C6 99EFC72E981E6D1F 891E5165A7EE640A 9625C2B7B278F52D BB384E8E245ACF25 12E3EB13EE85B746

Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170744 (name+title). Key = MD5(password) = e60ee9b3a33fe26383f79fa0255e238e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 836e1d40-15ad-5a27-a701-ce66c637d2d8
  2 a04528cc-14f2-3fbf-89f0-281fe5468637
  3 db65f71c-1237-118d-9fdb-52689553361f
  4 2555fcca-f463-4be9-ad35-1764ebc154c3
  5 20876206-d237-5d95-93f1-d8fc9b6aae73
  6 d3cdcdb0-be04-1f06-92f3-1485a6d4605a
  7 6efb099a-634e-5927-b344-7d58ae047d51
  8 93313210-f0bf-7fb7-9080-5a9f56d5f496
  9 e2b78982-04ef-4727-9b8e-5e767ed6b5c7
 10 8ff480b3-b7d3-723a-8bde-4b8443dea647
 11 1060207f-d05b-624f-8d73-19561a8f46df
 12 e0ccdf2a-d82b-8fc5-90a0-d5c2d0f738da
 13 5114b5ae-22bb-702c-a87f-b96a30e320cb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5314515747687. Exactly this sequence comes out of new Random(796).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 96 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related