201309041259 1lpd36

explained decrypted filler

seed 817

Metadata

Post ID: 1lpd36
Title: 201309041259 → 2013-09-04 12:59 on A858's clock
Posted (UTC): 2013-09-04 08:59:55
Timezone: UTC+4 · title 12:59 against posted 08:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309041259) = 9f882b45deab90b03451deefb142543d (name+title)
GUIDs: 20
Filler GUID seed: new Random(817).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 36 · predicted N = 20 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CF101F491DADDE43 9AC2BAB60D9B026B FFE3BA51C5F3864D 93C73907255F46A0 6C2931A615A10BC6 DDC554F2BC2A9650 792BEA6CFF5385AB 40237DD3B91F04ED 7798DC23884BDDA5 1C8C0B681CA695FF 8D6FD7855BCB810F A874D8B2E6DEA6EA D4F4C2C11BDDB62C F1E981DDE9920BF5 3273A3CF324320B2 3B38FFF3D1BF392D 96E208D81DB0F57D 261FF22ABFAAE203 F70BB9826A195AEB 08D60B4F3E2FB204 3718EE6C3BB00190 90CD736FB27B8F2F FE361F1C344679D2 300852F15B7C9F9B 72B9B79E57EB47BC 595840D13C6AF299 1E58DD0D8513ADEF 16354F8AB59DEF33 6C9C4237FF90316A D18D4088FE31D280 B4B01040B93AA60C D18644E2911D4AF1 6E3B553DC2B206B9 5FF5A79F6716FA4B 5F5A1F905A35BD18 C3F69C22FC81066A 0AEB2D991DA5288F 7022EB6A9114A6C0 6FB1C6209537EA76 FF9C8630AFC0CB62 8E2958397C5F177E BE537020D38ECBB1 4E90DA706AD4442D B0AA1EAFBC0170CD 08B59DB0A9F3C0D9 0BA8973588027581 F89714B27C5A97E6 59B68B1E22E3D301 1804E2A06126F5E4 7BFE768972D960B1 F0DB5ED217CA4571 89127BE9924B796E B4492CDB843A3996 D039F5A21AFC88C1 274F7A12799278BB DF97C45022585B69 67FFEEB20E97990D 77FD16A8F26F5E4F 122622C35C522134 0717811F58C4C6E6 3AD81E79F12C0FF1 BC4C63F299A07E52 B0CF0AC780322D66 67436FA4873D18B7 AAE268E447D55205 7CACF90B4FEF64A8 7353F08DA2041F32 6B66528A651651AD 09971AA2D799C307 9B202FE32C309B3E E3E8DC02F5CD6759 48B8239773C68F5F 18D8E360CDBE0ECD 8D4347CEA9C0E58D C79BAD403A7CBB87 B78966C89AFC11B9 C3315D4D273BD25B BBFF3E64D28317B8 38CB500E6A95949B 0107F8B93B958D8D 38FD80C6CB514C34

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309041259 (name+title). Key = MD5(password) = 9f882b45deab90b03451deefb142543d, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b0c9ad56-69b6-46b5-a253-4aa28e0de567
  2 441b71f6-2b87-458e-81b5-6671d75f7874
  3 e2e351e0-1626-73ef-b372-6d58426b4a79
  4 a96c62a6-7dea-8276-ab75-f08edd8f3d27
  5 57300b29-91a5-0d2b-a1af-867e1b9f34e8
  6 1fe5fdff-86fe-4c59-a5ef-27f8653dd18f
  7 b2b7ee85-343c-8eef-83e4-8bb815514858
  8 99c0ded1-2f50-288f-bb6e-ba359bf1c4ec
  9 d0bb9436-d27b-055f-b4a3-fd5f427cebf8
 10 27f52b1c-c9fd-4225-8517-38b11862636c
 11 b39228ef-2a3d-1131-8cd0-0e3778a9cd08
 12 762d869c-930c-2f02-acbb-de87804a6e6c
 13 06fc1666-f392-2dc2-8f2d-c15dbe1ccb02
 14 88e79a92-c6ab-47b8-8196-c31f505b66fb
 15 f1a305b1-1fd4-7bc6-a77c-e0e3d9da9e6c
 16 6306755c-cb95-23e5-bca6-0d0db7202bc3
 17 eeb602de-1a1e-2fc1-b1c3-92cfd3b6ecb6
 18 91186b68-2d22-4874-a5b3-95e55d0d9eef
 19 8c5a96d5-dead-7007-9121-0119f55422ed
 20 1ecbf932-0ab9-59d3-958d-3dcc9adad30b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 44780482041224722475. Exactly this sequence comes out of new Random(817).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 36 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related