201309051859 1lscg9

explained decrypted filler

seed 161

Metadata

Post ID: 1lscg9
Title: 201309051859 → 2013-09-05 18:59 on A858's clock
Posted (UTC): 2013-09-05 14:59:53
Timezone: UTC+4 · title 18:59 against posted 14:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309051859) = a34bc7a0420e7f9601c8a6982cfb8552 (name+title)
GUIDs: 20
Filler GUID seed: new Random(161).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 46 · predicted N = 20 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 1
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A07BAB398AB29057 E2B23C5A6405C8CE B2486D5A797907C6 4A18403B241877BF 0EFFB97A7E25C48D 3AF86357543C4309 CF64B7EB5E64B8AB 2705C5EED67F75A0 2C6172AFB7F0ACD1 44B8B4DB3A739458 6E251DE3B729266C AE0EEF0F3A36585E B1E2DC64494BB549 A773755A9532E445 110452F9495208C1 AB1BCC7878AF7320 E5C1DFBFD2BCE7E2 91DD1380751BE26D 04F0B05980288113 30898FD41F2D16CA 53E7CA6A3ED1553B 47633AF644D5A54D 188D5985F8E31B32 1760BB9FC43363F6 0F11187C458C6427 65625F82049363AA 7BF4E4E55118C3E8 81A8F7820A20C481 9B866542CE845C74 6D4931A35F87F337 5334DC20795BAF2B 0FC2D0F8E1C504F7 CE2B9A8C31611662 C2E5118AD0FC48DB FF2F7DC0AF528187 5F0D168ED7E37EE9 DD97B366BE4AFB0F 7B6151E2E35B037D 5E7853A519E0F9E0 567B96A29B4F52A4 45661F8719179420 2C4B3940B6785078 BD45025B92705076 53281E401EFA08D0 FBF5C3081ADA492E 33068E2505C11FD1 584369712E55FA35 5A7D001DDC21BBB9 8085E64D4408E51C 172B995B5AA5ED48 56626440C5F8FDF4 9064052397A04A07 0C2D1E341AE03A6D E364139B4BBB5EE6 DCF789E54FCDB7A1 97A8952CDBEC9E99 73D1009925BA6E1A 38A96257ECC13A0A 1F451A397436068D E8F742941DE0CE9A 05B79C6C939CFFA0 360CECDB22554F9D A9A4E027183B2026 CC6FBEDF6DFDBEDA 925447BF6C8B8D21 D300030C93923826 CAE80295D3C16DBC 0EB3ED5E21E201AC 6A93CE27CA2E7147 44EBAC9C1E914A10 EB1F48F4D0DD0478 6B2A474A967DFDF9 81264AB96A3B35C8 320F66A799B7BBEC D4B6C62C47CA5B5C 70E5157E431C42F6 8DEB7FC6F629656E 500167E4AC84BB1B BEB84FDC5C0E8F7E B0A13289EE70E67F BDFAF2D68D4BAB1D

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309051859 (name+title). Key = MD5(password) = a34bc7a0420e7f9601c8a6982cfb8552, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a16565af-3083-7243-b417-2853683d8fa8
  2 42d4f548-745f-0dcd-ba79-d839a58501e0
  3 7c2b124c-d5ef-2ef3-8624-a2a5652729bf
  4 b402f3f9-e83e-805e-9083-11cb3016544f
  5 2c16a563-1d0b-8861-b5e4-1fb447639e99
  6 472a3399-ce9e-2d7f-abb2-2bb38f0af667
  7 2212abc8-9803-0059-ba9b-de9f8c0d680b
  8 727fbb5c-e28f-114f-8bcd-1bc912310c2c
  9 f658aac1-c80d-80b5-9fd5-c00833471140
 10 4b0b34f7-f42b-53b0-ba68-b4345942e1e0
 11 ecdb0ca0-b9dc-8356-be7f-1be9de4ed457
 12 dc59f55f-60f1-1400-b88c-7b746cd6b0be
 13 5a205921-5c50-2b8e-9efb-dfe6584b7389
 14 74a05562-82a4-21f8-b83c-8a940506b2d0
 15 028cc52a-6ad5-6b32-a553-2c98276a604d
 16 a9a25657-0d12-50d2-b2cd-122d9715c07b
 17 c9d43efa-1c80-478f-a54e-a056e41b7638
 18 da6e491d-dee3-7ebf-ab10-e890b2278541
 19 8f59a161-a1f2-09df-8113-dd86dc8dd2c4
 20 e4f4ac6d-778f-53b9-a0dc-c9be5440c592

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70288201858122654705. Exactly this sequence comes out of new Random(161).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 46 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related