201208170747 ycg53

explained decrypted filler

3DES(name+title) ECB, 22 GUIDs, seed 245

Metadata

Post ID: ycg53
Title: 201208170747 → 2012-08-17 07:47 on A858's clock
Posted (UTC): 2012-08-16 22:47:20
Timezone: UTC+9 · title 07:47 against posted 22:47 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,424 hex characters · 712 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170747) = 04af4e2d41681a2af2de26542d07f8a1 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 22
Filler GUID seed: new Random(245).Next(9) ✓ verified
Run: Run 24 (seed 39,416,093) (seed)
Draw: 97 · predicted N = 22 ✓
Machine boot: 2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C9931F53A55F0B13 326C20CA34A6B7DD D2813C93D3A86082 5EE8FE77929119D5 51D9BAD6CD585CF8 4BE3C3CCBFEA5081 9E627E0BFAACBA0D 73260ECF6B03ECDA 6AC35E3FEA9E97F4 606594BCC245AA63 A4793F47B7D451DF 474C87B2CF9CB277 7A69B291BC7F323E 57AA12A447D74F43 80989B22D18C8741 4FF861BC522D337E 1290A2BB3F971E7B 7B886790A5677359 B844147C323E1BD1 AEA692D6A8D16CAB 4F5B1DD2AED28ABC E00938D9A1AA5896 F27427DFCC9EF9DF 2CF0AD085E30EADF CB1A521836A50B3A DC121ABA88AC9BF6 C331889AC161009E 4117620039F369F5 8BD7373142B5624F 56F126F814A2C298 52AC437FC178C274 C861DA137C7BF7F5 916B622673DF2E08 CC65B6B9EE5D0CE0 6C4E5A973E0109A1 50E9AAE0E94B2B4A 9F7E1BC712649518 C7916154EEFB3C56 6B36825F121CD8D7 2E37D4156A35B737 724FC9C64D455D80 93CCBC16F10240C7 541E3F9B6D4F103D 411D06A6701414B4 925DBA22C4A15214 146137A3247C213E 93191F8B04D9DDC0 ACDAB8FB44A5AFED 050F1C6899950277 5BA1147D0C152F6A 06A69CB2862958E6 1F16905FDB752EAD 566FF904A5FBFF1F 4928A79CB446D5D1 A8D78E715E2BD71B A22D6BAD79507122 114020E784DF0672 46CB3114C2118D99 882B5E3D31903844 8F1E8E34C65149F9 093F51D6BCF68F43 F63F70316EF91345 1E6F4667D9DCD43B 432969BFC2BDBF81 C88CE2A367B73A73 A9C01F26EF64FB0A FE17978D5C7A3554 B3973524B6F0D10D 8DC65D4D28A0586D 78A99BC11C97F685 3B96ABF19DCE86D0 1ADF20B4A3193C9E AF658DF1DC4BE090 BE0392FB12328575 B1B1F9C3C7D8CD9B 63CFDADD9443312C 3890A05BC56782EE 926EE66BE9B49A25 BD37E24A78181C08 D020460457F3FA98 D39F7BEFB6365518 6C7A20C93377B4D3 19A88606B00F42C9 58F9C6C079BA6CCF 465BA58274EEB131 C19220E53DC634BB E8F087503F1F046C 9BE5E24FDB5F07F0 58250B5DB2E09194

Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170747 (name+title). Key = MD5(password) = 04af4e2d41681a2af2de26542d07f8a1, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8bdb580c-87b8-6ef5-b9ed-5558fb38022a
  2 e03708ad-8d46-6ddb-abfd-59619a118fce
  3 9435d346-d036-0b06-b87f-6b5301688059
  4 c10a355e-15a5-7cff-87b5-f6f7d72722cc
  5 3d3927f5-9b97-791b-a156-8898255e04c7
  6 141cfd13-2882-5d76-912d-586d4d9f87d9
  7 f924ab65-4ff0-62e5-b300-fb1c1057c036
  8 fe0f882b-8967-3f5e-8215-16b78ca5ca8e
  9 5f374b49-77eb-2cc0-b33a-19aca42195b6
 10 acf7e4f2-6193-52ee-91e4-0c54a1894373
 11 269fffee-9211-7f27-9b51-0a2ac40f6cc7
 12 f52e6485-02a6-6487-b84c-7a0502752428
 13 7e62945f-86ce-076b-987d-f45ddf1685df
 14 73373c1c-ac12-8ce7-8722-dbb6becd7fb0
 15 08cdfbf7-ef00-44e1-aa7d-5a4159e31133
 16 71042f67-f996-0286-81ff-fe6ace244cee
 17 c13b6365-4867-7b9b-9285-07c0fbb70f32
 18 f010817c-46a4-8ba5-a2e8-c8751c0e9bba
 19 6a5452e2-b1fa-2d50-a9a3-2c6977def1da
 20 32fc95a3-028f-147b-a65b-297bb441078f
 21 436bcdf6-56ab-321d-8691-8ce4e9c1456b
 22 324c3e31-47f8-8b5d-aaf5-65c7db4802ac

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6607756325760840782138. Exactly this sequence comes out of new Random(245).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 97 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related