201309011859 1liohg

explained decrypted filler

seed 174

Metadata

Post ID: 1liohg
Title: 201309011859 → 2013-09-01 18:59 on A858's clock
Posted (UTC): 2013-09-01 14:59:58
Timezone: UTC+4 · title 18:59 against posted 14:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309011859) = 9968b79047aafb13834cd59ccc6cb5e2 (name+title)
GUIDs: 12
Filler GUID seed: new Random(174).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 14 · predicted N = 12 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F07489787B179B5E 17BF7F1AB511AE33 634CFE31C1E2F371 F506A866A3D8EE74 229356DAB60C2FE9 9F53FD205320C953 9080B56BD6E61048 B486C5494A9A9EC7 8F3DBCDA3A2569AC 92AC0A7C06209DB0 CC0B18B70852B286 CB28B41754261F50 A85BB0D9A2C3C810 49F5D11E56B279F2 856A383B20BFEC3D DFFEB16F0851E75E E1AFBAB2F248A6EC 68FF4A25B3C4CBA9 2048D8120A68CCBF 5CA5E52332CBB3E6 5A8F8A46E0BDBF82 CD1D940CA267D4A6 A58EFC98FA58320F 00A72263BF652AB8 ED3B82CFE8337B9B A45BC95D2847D021 D24844276B81AD68 95F639337953562C 94A99FE5A1EF5747 17669A8C0EF62B39 004C90FC451EAB9C C1AAF7BE29E0E136 EDEB23AA83C3B1FA 5DDAE396FE978E4F CC1F66DC718BFE65 9E8217AA5C6F10D6 571789DEEC8D0386 EB478803C136B47A 058D6E1CA3C9B99D 35FA3AA1DE8AA16F 8502C523CF4525FA F08260AD559CADB4 E58ED34C1D8EAB65 FA59DD0EB09A1CF2 7377126508632167 60448E83B93ABDF9 327F7039531168CD 3BFCE70D104A3C43 67167A5E2A9767DC

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309011859 (name+title). Key = MD5(password) = 9968b79047aafb13834cd59ccc6cb5e2, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5480ca3f-eed5-5450-aee0-31d8c8e151b7
  2 55e6267c-ecf7-791e-a23b-3fdbd0810a53
  3 990de2c7-a8c5-3cf4-b241-a28c40bbf162
  4 32382f91-6c1c-63f2-b52e-23c2f038435c
  5 c609fb37-f516-688a-871d-72ce99a8da6d
  6 120b7750-fe18-5ba1-8a08-9f4bf2c500f8
  7 95cee6a4-bb50-735d-93bc-e1c6da136c73
  8 8f1e416f-2fbf-67d8-9cf7-2d4b17353b9b
  9 6280f89d-616c-4acf-958a-abc5e37aeeef
 10 2821df76-cc08-3485-978d-ecb52756e005
 11 25d23e01-ce8c-4973-a32b-264f5c7df51b
 12 125d221d-e306-2398-8485-fcad56309a89

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 573665764342. Exactly this sequence comes out of new Random(174).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 14 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related