201208281646 yzc0u

explained decrypted filler

3DES(name+title) ECB, 17 GUIDs, seed 239

Metadata

Post ID: yzc0u
Title: 201208281646 → 2012-08-28 16:46 on A858's clock
Posted (UTC): 2012-08-28 20:46:33
Timezone: UTC−4 · title 16:46 against posted 20:46 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,104 hex characters · 552 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201208281646) = a74210e202403d48b00fc95cbcc8a989 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 17
Filler GUID seed: new Random(239).Next(9) ✓ verified
Run: Run 26 (seed 1,159,248,375) (seed)
Draw: 7 · predicted N = 17 ✓
Machine boot: 2012-08-15 10:21–10:24 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F33B84615A1710C3 8D80A5E4126D3860 FD3F0F2B3AC114FE 0EDE5897BC855309 1A537EA6E22E78EC 4FF67B8BCD454CF0 F8D900DE77161E84 352DF18B415D7EB9 86B136282A48206C 2612F75FB40476D6 0821AD9D120F72EA 5B534AB413B49820 F19E6730AD09F5DA CE30D1A29D46401C 22763A541096872A 5B582CAD75C88512 39CCE25EF39453F1 CB10E7765CA0DAA3 EBEBEB10E73F1A64 D20488A7AD84D63F BFAB7A65E28AAAE3 AAC822E413337B5D B998491615BE6899 4A0C1A4097AE14F5 2F42B42324C6CD09 6761A47479959F61 2B3451601988214C D2B96B45C69343A5 72ED7FAFA735AD09 DEB6BA3FCA93DD88 49D510B5B158145E 8C9ECCDA88CA0155 3A3E60FE6FE56326 77AE0ABFEE621C46 6A597533ABEB0620 2DE26039B815A38D C6795D8E21263226 140D38EBADF345F3 8D5FDCF59E77F90D FA93BC0CBF808E4B D62759D7EE21ABE0 0CE6D920C9BB5B24 E7A7E2CAC1038E7B 1601995D60247F8E DB9AA21182AF0843 08DDAB1B5E6B6AA2 9D7C57B3E550469B 455D6DCDB35B194B C0A85890E064C8CF B5CC3333431F20A4 10ED7F81935EE063 B2C1B79FD78F2C31 7A53CD6EEF008E15 E3214A0C485EAA97 57527E988A7D9958 58E24928064215AE 767ED8C5964FE92E 3D87BD74CC9D7529 075D0AFEFE5C2225 89A99082D043C9A4 5644F90D055FA776 69533C7414ABCF9C 98C1550F879828F9 2DA8BE82D958BD3D B0BF798162E57860 158252F8BB1DC863 0AC9E71AD792DC70 6C45B29DEB7AEBE4 E99205D864CD5DC0

Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201208281646 (name+title). Key = MD5(password) = a74210e202403d48b00fc95cbcc8a989, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 446622c8-0684-50f2-900a-729bc41bbd1f
  2 0afd2217-aa28-85c4-a7c0-e3ebd1da3a3b
  3 962727ed-0aec-7793-9cb8-331d11fa0fe5
  4 40a585f0-ff7b-5feb-b854-73abda535980
  5 60716bc2-5108-1eb9-88c5-dd16f2db4a45
  6 2a181591-6c2e-38f6-89be-32c2965df2f3
  7 944ba0bc-f768-8ae3-a6d3-45c7775ad878
  8 0bf276da-50c0-3f9c-bca2-c3dacef1cb46
  9 9d239925-ce3c-46e7-8bc9-9033e3ca27b0
 10 ce402c30-0ca7-3684-aa9a-d0c85fc7e732
 11 d43c3859-d8ba-33e0-95ec-fc0740f93928
 12 97005456-0a6b-0dce-b33d-dfee319b8a7b
 13 b86bdea8-8a0b-8025-b82f-959f0af905cc
 14 cb2ae115-dd9c-78c2-a54e-c88d8525cd66
 15 b44f9a45-6afc-2815-9a34-43439dc7c390
 16 c43fc8b1-61d3-2b3e-9285-de2565b6917b
 17 905481cd-29a0-2652-a208-cad2857c9f25

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 58751383433087222. Exactly this sequence comes out of new Random(239).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 7 of Run 26 (seed 1,159,248,375): new Random(1159248375), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:21–10:24).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related