201309012159 1lizdl

explained decrypted filler

seed 997

Metadata

Post ID: 1lizdl
Title: 201309012159 → 2013-09-01 21:59 on A858's clock
Posted (UTC): 2013-09-01 17:59:58
Timezone: UTC+4 · title 21:59 against posted 17:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309012159) = aed9c993b4b20d756d1b8b24aff22d25 (name+title)
GUIDs: 20
Filler GUID seed: new Random(997).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 15 · predicted N = 20 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B13B58380E45D289 9E57D43AD14B4621 3F5C5181CFA92EC7 6E9BA533F217DC0B 5C1F16993EDD08B5 C6CCA887F38EFBA9 393281043DBC529E 6061DF4B01FDB512 0079D5E7644ACA27 2502513F95A3E319 DA24332322128617 19F31048F0D3AD66 30907E92BA126B71 68483B35885C6F06 243A5E59283BE80F BBB17C7FB04477B5 3D03F2699AD2D923 2FB4202BEB396A44 B713EBEDB9F204BA 7672B0A0622044EA 62CA06F9ADF6E19A 337684C92562D9E6 84D468170917D9A5 CB42AB45ADAD6741 A969D8375C7DC5E1 A52500E7EE1F2E9E 2870092488334EFF 932BA05E46D58FCE 60D0D65A39B8DD2D 09A33489C2DC1641 DADDB9E70DD50924 A417295FE619994C D3BC579461F9BAF3 A52466C33A5B2FDD 20D933275261541C 35B1880FE15606CE F33DDD1F731207CA A21F7463F681A70D 797F87F29679EC9C 5971F032920DE48F 0DCEDDF4C41BF3F1 79DF63C13A23C61D 7855EDFA64B2B1D4 8789C2324776AE67 91F2AE9CFC15E233 5CC28C4454BA842D B3F5C564BAFC5359 D17742A75AB956FF AD79AF1747F20470 C63E9925203782F3 000E24564A68BA6A 20AC7DE6CB7F8D45 6906F773DAD858BF 22F41481C9F4A18E 1FA0493338BFC5AB B8C7CDF3E4D38CCE 4C85D63D49B91899 00450C78AB51993D A1751164B487A008 1448D0637E7F4C59 A9CBFBA748FFF208 994AB3590095A6D7 A5AC1EBB209B0721 B4B9B3BD6C59210E F65DD3E45C30265B AA4379CFFE937376 64D0B707F3B680BE 1763F04D2D5F66B0 311597D3667A7294 782EC45B2A965336 80D5EE64534967B1 75436CC1B14F5AC3 81D5BF82071CCC52 8FFE2C4CEE4FE335 BFC9698D180D9A2E 98B2DCC3C3C6CE43 29758CF588845950 83EB7D0F95D4F2A1 4374B9B2C29F14E0 F96569E2A17D00A9 1F2CF929ADB64907

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309012159 (name+title). Key = MD5(password) = aed9c993b4b20d756d1b8b24aff22d25, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3b7cc8a0-0b0b-548e-9477-c404096fa0d1
  2 e5f620ce-16d5-3fd2-aac2-6214d8eb8d87
  3 8551fb91-5620-55fe-b50c-86093f3af7b9
  4 bd352b0a-8758-36ad-a075-05f13f2d6647
  5 da4d3e46-05e6-3390-b9a8-0d587e86ec9a
  6 932c65e3-bc63-7d0f-8e50-90bbc7fa460d
  7 66507145-18a1-59e1-b098-b511296b15e7
  8 d92173fc-c5cf-503f-b7d2-6e24a46ca01b
  9 8ce7d399-fd5b-2b3b-a60b-d19169cc797b
 10 24953156-8fae-8922-ad25-cbe096e3c5c7
 11 3c649de7-d64e-7f61-b40a-91a88b1869dc
 12 8f384f2a-522c-7c2e-8665-c8629b7e971f
 13 5c9a6f84-52d7-0a6b-94f8-d872d804005a
 14 5828891a-1303-1fbb-93ce-d1d204acfa16
 15 c6b8e2dd-3de6-7bcd-8f0b-264286381d30
 16 3d80ccfd-b8be-6d8b-94c1-e1ae7feb6872
 17 ee2f82ae-5d6a-8c21-9eb3-9be75984a697
 18 a4a2e901-3ac2-1c93-bec6-56af58786dde
 19 dcdfa115-914e-5e42-b165-c58d8679038a
 20 4578a8c3-2d30-37ff-9092-fcdfeaf30861

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 53533755287701768153. Exactly this sequence comes out of new Random(997).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 15 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related