201208170413 yd9ey

explained decrypted filler

seed 165

Metadata

Post ID: yd9ey
Title: 201208170413 → 2012-08-17 04:13 on A858's clock
Posted (UTC): 2012-08-17 08:13:43
Timezone: UTC−4 · title 04:13 against posted 08:13 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208170413) = b0f6ad87517f0f1b4ef4cce8e816d8b6 (name+title)
GUIDs: 17
Filler GUID seed: new Random(165).Next(9) ✓ verified
Run: Run 25 (seed 158,297,437) (seed)
Draw: 11 · predicted N = 17 ✓
Machine boot: 2012-08-15 10:14–10:24 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8D0931BB81F094BA 98435BFD52527D37 34474B9314145EA2 4DF9D7170D0D555B 317A7DDD9AEAAC14 6F22EA11A9264EB1 6819BE6FD3A230FD FC73F19E5625F6B2 5BED388DF80EFEA8 201664AA5ADA3012 3396B5DE8CEA3626 B46B28A874B89C2F EE71D885376F57E9 035D5DF7F970195B 3D65030D374FF774 28BEA74EF9FB8ECC 928ED12E09B26D6A A01B84192A5B0B9B 9E3BFE5A0D8D8814 05151927057BE176 FDFEE99659364443 040C95408102652A D3F130716C06A801 3CD84F003F82BF08 A3893786AA73AF24 E84ADB81F32A39A2 CE0D3BFF07469B27 42C8DCD89881640E 738D751A391B0AC2 42DD047CF3FDBD2E A863D6A2CC324DB7 2AA41E4B87BBBED5 0438E3A1E33808AF 4DCF7708568F40B5 D70594CDBD50F105 4CBF760B4EA18B5A 8D5C1880F4DE70E9 0BA46A71A7D703C3 9CEFFC21969DDD91 58A8B8FD705D0366 BA97909BC9A992EF EADA11A431B8270E 6FBFCD0FEC1E4713 F6BB57EA3E627E81 12C8DBDD6F251B9A E9E71BC7C142EDBD 577850BF518D5530 E2F9D6104177B488 FE5A937BE78DEDFD 497E199A4488D7D8 22D91089B4EF0D87 F351A5A77247BA20 D4140F2A0788F60E BEB8843420A2A939 BFBA4AD3F46CC6DC B9D577DB1C8DE54A 516972B4FB9444FD E704CF4467EE30BA 17E601F9752E0232 913381571366B8FE 588704C1C6F8800D 3759537114F6D8A3 08DBA1E18384F4B3 303B69263970F72B B7D25F546AB8B207 EC7DD11812DA5B59 A1C93F5844311669 57AD547F329E1BD0 6462C39D08B952F6

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208170413 (name+title). Key = MD5(password) = b0f6ad87517f0f1b4ef4cce8e816d8b6, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ed025e31-271d-8245-b90b-0375e2cb8774
  2 54134057-c7b3-2733-a590-ce17be67d8a7
  3 eb042131-1cdf-0142-a0f9-88de677fdf29
  4 2c18cc80-cfb5-636f-8152-b4618c8df35f
  5 f1971a2e-c06f-6c6c-a166-aaa507aa4e4c
  6 7e74ada9-899a-63d0-aca7-d13544f17751
  7 d70e82e6-a54a-78b6-9152-6531b8da0507
  8 7cbda6e3-291d-1529-b3a7-0542907ab9f1
  9 b8df01ef-93e1-35fb-9b9c-c67022be4226
 10 b9081d77-742c-1709-b59f-d7c245ed2d93
 11 af4d3d82-d5f8-75f0-9987-b90af6e5ad3c
 12 3e7636d7-3a87-22c1-828c-60b60a961839
 13 7035a91d-66e3-033b-85c4-f8687f6a2f3f
 14 4b3f13be-2820-2715-a1a1-07e8a67f5ec1
 15 fbee1a15-f4ce-4d95-9d9c-c2b166fefd08
 16 f8118cce-264d-0e4b-b3c3-46555a14f76a
 17 5f0bb9ff-e221-1a80-89ef-2f5cf1b9cf2d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 82066671317202401. Exactly this sequence comes out of new Random(165).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 11 of Run 25 (seed 158,297,437): new Random(158297437), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:14–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related