201309021259 1lkg85

explained decrypted filler

seed 294

Metadata

Post ID: 1lkg85
Title: 201309021259 → 2013-09-02 12:59 on A858's clock
Posted (UTC): 2013-09-02 08:59:57
Timezone: UTC+4 · title 12:59 against posted 08:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309021259) = c6f3b94a71b1bde9ebc18885813c3c6c (name+title)
GUIDs: 12
Filler GUID seed: new Random(294).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 20 · predicted N = 12 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 4 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F3AC8685DA970EBE 069D86781FDC9BB1 7582322044A4CC5E D74C6EBFF9D6AD63 AEDDA543A7C972A6 408F542B9FD4DAD4 80A4635510B96060 68146587CD6EABDC E33FE767D59CA088 F19E91321E4475B5 FBBA41825D1473AB 2424EA89AF096C73 802790FAF1B4A6BB D51331E797BCE0D2 8A1EBA9CCAB1251D 29FD675A2012F144 EB76D74AC71E10C2 9AF68F2D2570DBDF 12BF472FC36B5D86 3E03F8BE1D84994F 5068075AF4A4FC62 071569D8EF6F7BCC 6364AA2C6D55C4C0 42B57071BDDDDCD0 470F8D5FEF702170 A6AE354B146E32BE 606FF6126E98CF35 9BD943B37C663E0A D002DFF444F31FE9 CCC750F5A0B00F3D C8D3D34156E977D5 F11E8E73CB13324E 784FF24DD923AA39 166D7E2B70E82BDE BCF6795D9B53D55C 7C944E6150B02443 A549C20450442A80 F88CBDC4842F5CF4 A939CEAC8300B727 103E028AB9980510 B59A70D9C7B4E6C6 5F037D2A4BDC807A 9849697D46FB3A2F 6F551A83030D233D 61EA00E91F10C2CF D73C9B201F40C987 649A9620C22F6D33 8779E2F66AC2FE7F A6D4D4306DEE34BD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309021259 (name+title). Key = MD5(password) = c6f3b94a71b1bde9ebc18885813c3c6c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5cfcd1fe-66b3-2ee0-8864-302523a2bb7f
  2 6031aa5e-4ff0-0b2f-bce0-1f7ce6680bbe
  3 ab617c13-1607-2c74-8b1f-1ac88ac7ff1d
  4 1e5a757c-1f29-25b1-ab59-c47fa5be227c
  5 ee83ea99-a1c7-80ea-95dc-d7067d479516
  6 5fbce2f3-3396-4186-aac7-1a6fbea14730
  7 b810af58-0db1-5294-a19d-efc384bb53d8
  8 624beadd-7e5e-88f4-8553-de1cee470000
  9 1d83dcd9-efd2-3105-a715-0bdf15aabb99
 10 9289c444-d4a5-67ad-b696-149e5792445f
 11 fe21c291-5b12-8054-8fbb-41fac9ee40b6
 12 777d8e2c-625a-8c73-aa1b-3f9df921c3cb

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 202284583688. Exactly this sequence comes out of new Random(294).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 20 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related