201309031859 1ln9s5

explained decrypted filler

seed 652

Metadata

Post ID: 1ln9s5
Title: 201309031859 → 2013-09-03 18:59 on A858's clock
Posted (UTC): 2013-09-03 14:59:59
Timezone: UTC+4 · title 18:59 against posted 14:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309031859) = 3d12dba5cbdedb2064787baac1ade26a (name+title)
GUIDs: 12
Filler GUID seed: new Random(652).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 30 · predicted N = 12 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 1
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2AC8D84551AB8564 E55455A359238986 DA3D222059B65F63 5339133F5EA95425 F74CFC95C5E4D331 B29C03491B6ED021 A75FD7325FF681FA C490BBF32DF0DCDC 40BB659E059AF286 035F9C103DD5DA9F 173108A040B5E84F 95F33D92D78727E3 E932AC30BA02448C C519009C8E2C6EE0 2D7E828469E0C4F5 9314324D4D1338F2 6B5EDF33BBCDE406 F15EAE574BB9F7FE 252F1B4B177556AD 9CB2C715C9B712C9 E733355A93347DAC A506048F932452E6 16A8AA4CC4896AAA 7447AF9D41056643 516FA180C531C2F9 911480ECB4C4C572 71FAF766FD95175E 00AB29521B944A70 F716CDB8B2946D74 4A1CF3D438535F51 DF373E00E9AC291F 5DF50E245A9281A9 500D2702AF22824F 1F03884AFF3DA894 6E042D088F726B47 9FDAAB769BBAA023 650FA99AEED14E31 5E14C56CBD2C352B 8C17A74C418E43E4 8525ED674352A3E6 D509C5E1BD59D806 424140A6519D40FC A2229C00660EC1D2 6B6596BC1874FE19 715B729A5ACB644B 4A9A4EB1ECB566D5 9845DA743824CE68 6B422278A331FE9C 6DF30E464C47983A

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309031859 (name+title). Key = MD5(password) = 3d12dba5cbdedb2064787baac1ade26a, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 18349c8b-2c34-3a76-a843-a3ef28c148eb
  2 ad8324de-c399-1c11-9420-63d5536167ee
  3 11601af2-b3c7-489e-9600-fb3de80dcec7
  4 4da7efa5-25f2-6754-bf78-700c19a785fa
  5 a200475c-4a79-518b-bec1-d706e8cc2084
  6 c0eebe11-4be2-37f1-9220-5f063aa671ff
  7 015fd286-995d-062f-afdd-7ee734f1598b
  8 6a9444b3-0172-4a92-bb10-f9ec636ad327
  9 2e04b591-e0e2-5386-aa4f-267d5e022859
 10 a1fb86d3-88ad-6d31-98c0-74d770321509
 11 d0b64477-d8a1-5a71-82d1-8113f099f1dc
 12 eb59b8c5-207a-47ec-b77d-435b4c568b26

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 314653045654. Exactly this sequence comes out of new Random(652).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 30 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related