201309010059 1lhc89

explained decrypted filler

seed 138

Metadata

Post ID: 1lhc89
Title: 201309010059 → 2013-09-01 00:59 on A858's clock
Posted (UTC): 2013-08-31 20:59:59
Timezone: UTC+4 · title 00:59 against posted 20:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309010059) = 7d3c31085602679428d344969b8012fa (name+title)
GUIDs: 8
Filler GUID seed: new Random(138).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 8 · predicted N = 8 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

04C87BC72E4092C0 3B217DBE4D6FBBAC 9DB9E8B4D3CA1412 92BD417D1B5328B3 BD19D35035BD24C3 BA19FE2D88C12017 30929F11AF545EC2 0A09FE55B942D9D0 1100E0B7C22334EF 44ECB01C284B9777 37B29F0286A269EF 456690FC8E73CB17 56DBD89C5F04B28D A2881DC3B457E55A BF3D81043AE35AA9 886EDFBC9FA3BA3A 6005B7B5A985BDF5 1F9951F5AE840A62 09F5CBA1B20BB39C 95156012E3E11AAD 6B237A5C647B8851 FFDE48C9FE86259A 45716507DEACD65D 029068294B36EE7D EDC0B2458F9879A5 D7B82FA0C33DADF7 D6F941B0B937DE98 43677696D25FBFAE 21AD4F04C196C5F4 35EF84FD12D265D1 D33CE618CB53138F C1BC59075DF33DCC A171295CCAAFF674

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309010059 (name+title). Key = MD5(password) = 7d3c31085602679428d344969b8012fa, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a80eb8c8-7de4-77cf-80b5-8264a0c69ae1
  2 0c09a781-d59e-2e50-afc8-87f9c06fcc48
  3 93c750ca-59a0-20b0-b6d3-d459184b7e94
  4 76025b2d-abcf-05a9-af27-8ae68723d23b
  5 5e3fe4c0-610f-4974-9f7a-bdc48b2c8bcf
  6 58349179-cf2a-18dd-a556-672973677a5d
  7 dbe923eb-b945-64c9-b8d6-4a78ab79135b
  8 1e36a1ac-a301-6ce6-b81c-7fd582f0a66f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 72204166. Exactly this sequence comes out of new Random(138).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 8 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related