201309040959 1lp67p

explained decrypted filler

seed 865

Metadata

Post ID: 1lp67p
Title: 201309040959 → 2013-09-04 09:59 on A858's clock
Posted (UTC): 2013-09-04 05:59:55
Timezone: UTC+4 · title 09:59 against posted 05:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309040959) = 6afc0fafb70b1ccacfc99912da3d0178 (name+title)
GUIDs: 20
Filler GUID seed: new Random(865).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 35 · predicted N = 20 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E582ADA2EAC91AA9 5A1F3C1F534730D7 AD50841B808AED37 19596D965F1BA814 C6F261048032E714 63FA19EECB85E48D AEFF2AA6FF2D843D 0C30B85E018D0988 D3C26C4F08CA3DA9 B74CFAE5DE632EC2 25F2796257DE22BC 276C28726AE14929 3D579ED3BCCE40B3 C35F3C82497C1612 1DC0E9B85C93E3EB 476A2E4DD1A345E0 01C8A30F6CCD8216 2D16037035832E68 914C9C5E98E548D0 0823628527AE8110 3BB0CB10253192A8 4BA39A2C1D47B5FA 3FABD44EEC5980AC 08F7990BE82D58CE 6684A9159198B6C9 3973E3327D641201 0985F80BFA7A25BD F9557FD47018EFF6 3D040C963F5E2B1E CFAEAC3B58330708 F66F106761F84986 450C446FA3F74CEB 1A397B133449C1B8 F2CC551AB27366D2 41ED3FBF059B3DA9 B6B2DC5177EA8998 6C945040D00B0880 6531FD49D910A0E3 6C0F7D8D89C4AC08 76792CE1800B552B 40E5A7CC903B1A86 E760E79E2F471ED0 BE23F2123E83126C 673B199CC7615011 C3F82436358B3D7A A9933B416551ADCE F9D69EB55EF57F4A 56C7B51B9FB190F9 36C33DE0286AC9D5 9B5DE251A86EC67A 7E6C9A75481479EF 5D5D321C9AAE18EF CF27EE4AFBFCFC24 2CBFF9DB5A1C6AEB 559F671B1F288946 BD109408F22CC981 5D039FA950B28354 7101D7285958D81C 26A2C72F883CF26B B22E7AF4767899EE F62F3572CE3704C4 7E8F086CB96EED82 879AB5BA4A034572 B070221572365D75 84C08022EA8F1266 8BF12EADF9D18DBA 35F6C3EB5ED32C60 EA6329A268D731F9 B2CE6B0C660E82E8 1DC0929BD9587F30 F734A75F1B2508DB B071CEC00FEBC422 E96590DDAE21AF4B 7920206BFF133A70 01ADE626BA42AAA4 7348B2CD8460B203 B7C1F0B2E92B66D8 B22F89A9FBACD634 7092EF617D2F2254 DEF70D38C62FE4A3 A57CB147E6285D39

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309040959 (name+title). Key = MD5(password) = 6afc0fafb70b1ccacfc99912da3d0178, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 42c2e5ef-474f-5865-a383-a93cf3c3f318
  2 0dee3394-2b78-5b28-a94d-2413ac643351
  3 13e7761b-1320-39c9-87a5-d97dbf48ca90
  4 9bcd87de-aa0b-186e-9693-dff643ee60a8
  5 1c4ef7bf-49fc-6b9e-8065-a62c14690f01
  6 49415168-d74b-43b6-9ae6-6a3120cf6a87
  7 b95c6d0a-349e-4cce-a246-9e0c201989ff
  8 bca594d9-3672-31ae-9101-9262f5553c59
  9 8f7e78fb-0221-8416-b770-17ed70b3f061
 10 5ba88c9c-843f-2c66-bc8f-a888e39cbda0
 11 f5176ec0-488e-5a90-b35f-f26a4e27d569
 12 cd2e3d45-ba10-7961-963a-10a6dc75b214
 13 045b222a-4d98-297e-93cf-13582d44d8ba
 14 148a1da3-c9da-4695-b797-1ead9119bb6b
 15 56b250f5-ea4b-44ff-b0f5-4bb335555951
 16 25cb3951-e529-2795-8c08-da54a232bc18
 17 90a8fd27-c39d-452d-83c1-48244b3bb9f0
 18 89da4fde-0868-20bf-8053-90eaed8aded4
 19 524d7d17-dba9-0e79-8f3d-52cce2c1ed28
 20 c9d3421a-8aa7-20b4-998c-66a6e6b01d24

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 55316443825724424202. Exactly this sequence comes out of new Random(865).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 35 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related