201309061259 1ludjf

explained decrypted filler

seed 276

Metadata

Post ID: 1ludjf
Title: 201309061259 → 2013-09-06 12:59 on A858's clock
Posted (UTC): 2013-09-06 08:59:52
Timezone: UTC+4 · title 12:59 against posted 08:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309061259) = be6df3f755c1b832032f5b1eeabf427d (name+title)
GUIDs: 12
Filler GUID seed: new Random(276).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 52 · predicted N = 12 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

06ED78C19DDC9822 975F04E55F53CE1A 4CBE3DE966355CC1 6C1A59EB9D0514D3 B54EB05CD4D90B19 5FD977B46A5387CA 3163685F503EECE3 722A473FE8D1756F 6121B9DFD3EA1E4B 4B28CAAB91E81ABD 5334BEC47BBA2C73 B3E7041D03B9A6D6 9F84C2F16FAC284F 68E7D2FC87A1CA98 8632796874F4EDA7 D2B08D4ECF4E8159 01A70261A3551D7C F14114EAC3A3AA8E 87F799514E10E569 FB871590AE4F4DD2 7AA9F7A611840F98 C72D34E8352A521C 68AF5F10C8DE955E 2631DF501C1C91E4 13AFE33332D67494 311FF3B9463D7C1D 5A8A82B4EF450B97 F2210667B451A7AD 711D93E2454220D8 877B16DC350F8668 E2E7469025563B0A 0282327CACF3AF22 6FEEB59FA34DEEB7 5F486735F8099B6A F3297113436C0BFF 7D069FAC9902BACE FD760CA9B49ADA07 1A93EAE4638E31D5 FE1527B5183A2A61 D9FEA73F7BED8A13 5AE1E590F437705E DFC6DB3351717400 58B2EAAD3C517800 7A20C334FEBF7EB7 ED00C7DAE2C3ECF3 4298E38DEA78555B 724B57C469A33299 BF1123A36050A7AD 00AC40B08B02B35F

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309061259 (name+title). Key = MD5(password) = be6df3f755c1b832032f5b1eeabf427d, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3c46f5c1-380c-8c1b-a023-0920c50b558e
  2 d89b5624-9da2-78ae-a0eb-34237b503d00
  3 16d14685-a60e-61c9-b52e-e8ea34176d94
  4 8685103a-9609-40f7-b4f6-70f5c0ce32cc
  5 429fdc42-1d5e-73fa-a105-c07609683b46
  6 87b0e80b-1244-677d-8815-2d872a8629a1
  7 e34aec47-9480-565a-a490-c37106b04c54
  8 e2c68732-2a70-8046-bbac-c1e90ca42b1a
  9 799c2b20-1ebe-12f4-ab3a-74a388bd6528
 10 f7ddc27d-8f0a-05cf-a2f7-5c27ae09e21f
 11 137a125c-4a2a-58fd-9c76-a05b697edd11
 12 8efed74e-3607-870e-9ad3-54bc980bf158

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 876476581058. Exactly this sequence comes out of new Random(276).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 52 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related