201309041559 1lpjq5

explained decrypted filler

seed 596

Metadata

Post ID: 1lpjq5
Title: 201309041559 → 2013-09-04 15:59 on A858's clock
Posted (UTC): 2013-09-04 11:59:55
Timezone: UTC+4 · title 15:59 against posted 11:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309041559) = 21d8c3356a7b6cac68cc3f8047ddc88e (name+title)
GUIDs: 12
Filler GUID seed: new Random(596).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 37 · predicted N = 12 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 11 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AF01A31A965428D8 BA739DBC16237D3C 73B6841C742278E6 BA0BED5A0B921F13 C31D7E865C8592A6 A7173F76609A3DC9 0D4EFD3671192981 3820A8A037FE05F6 36D8EF90BFC802D8 9FA88355BEFF30D3 A3C75FBFBF1B2D37 D9AB4E39199836BD 13800C48DFCA5DC6 6CAA040B95954CC6 392DAE8FCAC9AFB5 6BBF8E3B305DAC8A 0E2A9ECB2F11491F 647994BA0B55D33B A688F5FF8852C87D 0377FD087AF29FFA 0D6C7FEC9B2B63C0 A85BB409C8EA6646 2CA3D60E17937D7C D707DA4B535D7F1D 52A65311ABFA8041 4CC58F1AF79A321E 946AD945F7F7854E 6AD08220CDC2904B DD00469A744E65B1 9B053EB04F67EFE5 A1A08AF792AF487B 226EA5C71AD21BCD D36655A72CBBBCB4 F26147BD1E074F31 EF80A5FF17CB2FF0 9634F2E8801F92C8 7E19A84D363ADD36 6698A055ECA17B78 73247E3E94CD9EA1 7ACA85FB917EEA28 88957D38B7AE4211 BAFB0230A806310D 82EF69D8BEC934C8 5A9E545EE1040EA6 423655928724E0F3 A79ED924927C3879 C25596D97A78E3A0 F2C1D123E6C46884 5DA92A3A0F9616A0

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309041559 (name+title). Key = MD5(password) = 21d8c3356a7b6cac68cc3f8047ddc88e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 03f0fb70-5fcc-0966-b655-1f9c5bfe00ae
  2 8fe279e4-1771-6dcc-92d0-d91f46c5d5cd
  3 a8b7a8ac-7287-3c8b-8c35-55e60bed3dc1
  4 ebdb5d7c-ce84-690a-8306-3625f7a27801
  5 3acab1e8-8fcb-2b60-b619-19d0e52ce225
  6 9a71fff5-c6ac-32f6-95f4-759cd1183fe8
  7 f73d9564-1632-818c-b9cf-80cd77c871fe
  8 7735a259-ebc6-4b6c-aa88-612ff5f086b1
  9 b83dcb59-7636-6b46-8702-2b2f8b97cd96
 10 a5c73d85-f308-0c76-8db4-dd6089c7c65e
 11 f93e3802-c219-36e3-b48c-89b372e263d1
 12 4cea4e59-2248-6ae1-95ae-d9151b23966a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 063623846036. Exactly this sequence comes out of new Random(596).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 37 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related