201309041859 1lpukp

explained decrypted filler

seed 522

Metadata

Post ID: 1lpukp
Title: 201309041859 → 2013-09-04 18:59 on A858's clock
Posted (UTC): 2013-09-04 14:59:55
Timezone: UTC+4 · title 18:59 against posted 14:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309041859) = 6bab2d188363c4f3e2e89bd3b2a67495 (name+title)
GUIDs: 8
Filler GUID seed: new Random(522).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 38 · predicted N = 8 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1321532818A4DF3C 4C434E827AB68B8F E8694514677D8339 F56B6A56B90FDAE8 8C1E9F388948C807 AB778F03B5DFDF0D 097387188A855F70 9688A04C8DB69C32 2DC2EE786016D0E9 498937069BC22611 C061E955535646AF 3763D82E4736D1F9 4E05E43440914A59 0183D7C78AED76B5 30BDF3AF0CD2F5D8 0AF0CB8720ABD08D A5DC1F23C215D07D EE38E1CAD4CDF928 D1A28307C5367362 9D2FF87B131AABED 262330D2AFDED8C2 F9F9307C46930F6B 507C570DE8DC63F4 18BF1FF612469E9C 4E308728EEF79CD3 4C80C9F410A1E4FC A301A67F2ED8F17A B2E66ED8AB023962 840037C23E13E572 4B2211854BB0BF64 6FBC10A9F5A2FCDA 8A981B911017F9CA 0560F73F208C0057

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309041859 (name+title). Key = MD5(password) = 6bab2d188363c4f3e2e89bd3b2a67495, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 19676f3e-0d66-3b87-9e81-8f198be28951
  2 40c184c6-aa30-8f00-984a-4945464796a9
  3 cb1ea982-cc26-5682-9bb3-74bba51f79f0
  4 8d3d0d05-4f10-8976-953b-4407ef02145e
  5 92450509-3cfb-753c-9e4f-3b9041ce74a8
  6 1dd13b8c-44fa-6b02-ba5c-97df1a7c6c2e
  7 20d6c011-59a2-7bd9-bf2f-54152cddf2d3
  8 a39be579-7459-2c11-8adb-6bf65a89d13c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 38587672. Exactly this sequence comes out of new Random(522).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 38 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related