201309050359 1lr0s4

explained decrypted filler

seed 966

Metadata

Post ID: 1lr0s4
Title: 201309050359 → 2013-09-05 03:59 on A858's clock
Posted (UTC): 2013-09-04 23:59:54
Timezone: UTC+4 · title 03:59 against posted 23:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309050359) = b881cc2b3999e3cd12d7f82f4b1eb53c (name+title)
GUIDs: 24
Filler GUID seed: new Random(966).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 41 · predicted N = 24 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 5 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E54BFF22A83788D6 BA7F59FFFD902FED B052A37EE8AF086E 9AD0FD37DCD8E315 C1B7C0088FCB82DF 9D9AF4624584C9F9 1FD0971439DC8FFF D3AC381A32C1F165 5C72CE52C784192F 6D22CD2B1D82403C 5E851D02D892F7B1 EA7CE963994B1838 70E87DD5613AB844 170BF846BE411B43 809FCCFA4E765481 9BE7A38B8F6CCE83 F75F3EF467692DE2 660CAB4D8DF5A8A3 A9E898A12826EB0F 06691ADC6556B76D 2F27B282F0393ACF 7B91B89B8614E280 AB1741931EC8252C 39FB7831DAD57D9F C42232C4C5310FE1 BA26BD8C5BD47782 80C71D2B7DF80558 B06E01F5E401A54E 57428560D655CE9B F5704CE68FC967B6 85CC6ADB58DB9082 2FFC1D372F953B92 5A675CF8B83A8E61 35D882D9EEFD83AD BBEC4264F766F531 1EAC708E078F75A0 960E727E260328D3 0F1F8619FDE8F39C 1673E896C3855611 2DAFA24CB68F1E32 4B2EBB908AEC7B2A F29B14685F46CB50 F3AFA50D48852FA4 847F335724248BBB E9429D0DB1003707 DB8920D4787CE6AD 350AE180AFA41B6D 27E758ED42933314 AF008B1D561CC7A3 55396191EA570B83 7D5AF955A1E93FBD 2EDDA52F11255E42 D3ECAEEE85390575 4466F1F3B8067190 A8251565C980969E BDAB242BD0DBBEB0 FFDD50386CF58929 9BCD3A2CCEDEFBA5 BA5DBDF3988E0821 64ED01BA2A9B50E5 399B75C65AF442E3 C240AB3778FB7925 0B95753D1725D945 0AA8F4C83ACD28FF 8A68AFE02AED09C0 43DEF3F3962403A8 B45BCAC1CE6995A9 3CE6EA7FEE7343A2 B7D83BE0832B50A7 9C4E9C16CE5A4B6D 740F51929094E574 BF28865ACE686274 24DD2B6E3ACEC887 66B1D92AAF40268C 3AF98962F0D888D1 79155E51583894E6 D3341FA3FB81B6C0 7B43513F739E0B8E 946728401B33EDE1 473CB031AC1344A1 8EA40C8F2AA6F295 F4848F4C4A0AC9F7 8CB544B6CDF13072 8E2ADA6EDE6FC839 D50932BCFDF36D5C B21CCAF06AECDAE4 18C8179CDA5E3B05 F1EDE932C6FFFEE8 D4C84EEEC31B502B 6489B483F71B464F 6FCDA335610A954A 600AC17A6469A41F 1E051BCB3561406F 2D50AF25FBFEDA11 67AF225017C0F469 9B4040CFD109F359 B4FA3360729719D8

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309050359 (name+title). Key = MD5(password) = b881cc2b3999e3cd12d7f82f4b1eb53c, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 74ada77d-86b1-32a6-969b-6d6b3614d287
  2 8faac230-8cea-205d-9405-5b7143e5f9b2
  3 b81031db-8d11-86d7-baf3-8f95097567b6
  4 3f522463-b0fc-6a93-83a2-bd0312f4726e
  5 f295df36-8f86-3e61-b615-bd9718d0fb11
  6 008ff760-ceaf-6b0f-94a6-8d6606dc4242
  7 f66b548e-b481-6ea1-bdbb-c037666275c1
  8 9f429dfd-ebde-04f1-aeb1-5094407c1811
  9 975f2ab1-38a8-4678-a67b-c35a0025a1e8
 10 bd659a18-6f4f-4804-9377-163cf2747502
 11 f30c6dca-7c78-826a-b6eb-6de3fc80c3c6
 12 997db377-e8e9-5122-9dba-49f7d6d7f924
 13 b1ea3f92-0931-6832-b770-af8c086efc21
 14 8f6294b4-fd9f-02db-b030-a70e99275b7a
 15 27b73e7f-cdb6-1a82-ae3f-fbe8bb608552
 16 6f0513a5-0cd2-2958-be29-740f84e6acaa
 17 81a43a78-6528-8e5d-9be3-e3f3d7ae929a
 18 54ef6ebe-f0c6-8d68-97a0-bbebc51cb61b
 19 7a485665-d3ef-79a2-982b-9e1dbf20ff4c
 20 5db535c4-fa7b-3195-912f-43f871cb46c2
 21 9538cb90-89ab-1618-bb62-f933f43ffb03
 22 623aaaf0-d460-7745-8f69-831d2064a298
 23 351c107a-28cb-243c-a545-5e6f790e342c
 24 10ca906d-6b5d-49a5-8b0b-96ec82260c0d

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 328636604485601288731724. Exactly this sequence comes out of new Random(966).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 41 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related