201309071559 1lwshe

explained decrypted filler

seed 124

Metadata

Post ID: 1lwshe
Title: 201309071559 → 2013-09-07 15:59 on A858's clock
Posted (UTC): 2013-09-07 11:59:51
Timezone: UTC+4 · title 15:59 against posted 11:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309071559) = eafedf29aef61be8355a0fe45e489a18 (name+title)
GUIDs: 8
Filler GUID seed: new Random(124).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 61 · predicted N = 8 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3FD3FEE21FA99C92 8A868AD73A65470B B9CCF3E5A310D183 5566B63BC94E6CB7 15E521666E235B9D 26A329AAF88FBA02 F4CCC785E09B2C1A F56BEE1AA2D8FB79 64178ED94AE7C3C1 60388D218F753937 D124EE4063BC41E0 0157D753FB6177F7 78014BDD379D6C18 239801B589C6D5E6 8884B8B45CC45317 DCAFE0F8FCBDBC33 A85629BA74EE61B6 B309D9713A09EE98 13FE13EC76DC40D7 8E875C55BD9EE972 ED6ED43C24A72E64 15AE1CA8EEE26BBB 959A1CA9E44C6D50 D4EEAF6BD7573277 B9CCDE8E12E3D108 E5DB77955548E8D2 78A0DB5D21F177E2 73687245DB91FD55 4F5BAB8F82725B44 0C5B20B26CABBF33 3C56FD8636F7F7F8 F0C550C921C5EB02 5149B6287C24CB02

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309071559 (name+title). Key = MD5(password) = eafedf29aef61be8355a0fe45e489a18, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a2cfa04f-dfd5-42ae-ae27-f37f5ea3628f
  2 de6a50dd-9090-1bd9-a8ee-4612a5741f96
  3 cac026a3-3016-3b51-ae70-1ce31728c11e
  4 05102260-a0a9-0b4b-b613-a6828aac9177
  5 ca770fb6-aa78-1256-ac6d-4d7c43ca7e15
  6 f6f715ae-19fe-8ba4-8d0f-99597b6bbbbc
  7 cc45c531-88aa-404d-b89f-9962de52303d
  8 90027a3f-3243-5679-b056-bd12ab24a275

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 41301845. Exactly this sequence comes out of new Random(124).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 61 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related