201309030659 1lmbvo

explained decrypted filler

seed 308

Metadata

Post ID: 1lmbvo
Title: 201309030659 → 2013-09-03 06:59 on A858's clock
Posted (UTC): 2013-09-03 02:59:56
Timezone: UTC+4 · title 06:59 against posted 02:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309030659) = ebb10b7ed4a2e9bb74dce6ab5f76834f (name+title)
GUIDs: 12
Filler GUID seed: new Random(308).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 26 · predicted N = 12 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5981BEB82D85D7D9 B452DAF2AB3581F4 966DE07544BBEC1E 507C2CA3636AE34D 846D3667D12D1436 EE440B9F183D8154 3B9BE387AE1124CF E6653E150F3AA34B CB586858798D033D C85B9B00B895EEE1 8B5EA5B4086269E1 082DD28CEAC1F804 8655702B9C7CDB26 71AFF383D0B2D244 2BA61D03CED1889A E2E446EDD414FFE2 EABD21BD4852437C FC09987717AECF46 8A550E7671801C96 963198E96369AED6 0E7539D376DE13AE BB274F15780124C9 163F0DAC88BDFC89 59F96A6952FC26D0 9C702D8E8D52BA64 D1302B6B6B203776 8663D08122827218 6A688EB53E7F4DA8 7D2C191009342872 132228B1A2F2A197 22A845A46BC5DE74 523CA5975243A87D C451EF45E2FD04F5 278A8FDBB357943D 2841682E8E0D081B 0217933EDE5E4E36 F9FF4520EEFD76FA 1C9ED592D752B1F6 5DD66E0B88775922 3EB0311818170F7C 4AAECE640B9D1242 0FA1FE5DD9E96216 02BAB19D3E106846 4DF9534067AA9400 AF8AFEA893893BDC 3EF8D4661CA4C497 87A6B1355A3B7402 4390CF4853A449EE 7F60ACA959A149FA

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309030659 (name+title). Key = MD5(password) = ebb10b7ed4a2e9bb74dce6ab5f76834f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9fd2d64a-41b5-5915-9bc7-bb660ae715a4
  2 6dd9ac04-522e-1e2d-8ef2-5d4728527599
  3 a25f9a70-4021-03e2-b453-eda366fdd32e
  4 93319793-0584-24a6-bf7b-845e515a7bb5
  5 62f80417-573e-2640-808e-03279ab1fd7d
  6 a1dd869e-1d35-6f7a-9bc0-7bec38e4b3f6
  7 60a22ef2-28be-8d60-a499-2ef71961c243
  8 4b2197c9-65fd-8ad4-a82c-5d78ba7ff4ec
  9 20266bb4-f53f-0d0c-9d87-1ee4eafc29aa
 10 da0506e9-81ab-7f3c-bdf7-8300e1163b35
 11 5e42dde3-8bdf-1248-8aff-069ae7a3728b
 12 22538d12-adff-8f04-bb64-f12d1e29004f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 510226880718. Exactly this sequence comes out of new Random(308).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 26 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related