201309080359 1lxyko

explained decrypted filler

seed 531

Metadata

Post ID: 1lxyko
Title: 201309080359 → 2013-09-08 03:59 on A858's clock
Posted (UTC): 2013-09-07 23:59:50
Timezone: UTC+4 · title 03:59 against posted 23:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309080359) = 6483fde8c798223f272838c2e6fac2fe (name+title)
GUIDs: 20
Filler GUID seed: new Random(531).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 65 · predicted N = 20 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1213B518E1A0160B 82818F6B216877FD 8697C3A7EA122A0B 684EF86A0CCF720E 664B73A77DCF9830 12A2D010AA66697D 42486F81DEDC7988 AE0000F78259E7D6 D35E01A1E778724C D7D5A391F7D7A112 DAEBB5F04D5A0905 8BA1A62587732E67 D9D450F9CB82DC7B 587F1EC650AFBE1B AA7869A7FF215D4A 2B1DF36B5AD49A26 2AD800D28657BF74 D5A649A30239A577 6906D78808988FAF 96BAD18E796CFA04 8F42EA9BBF7DBE84 FE569A9DF00BDC3A 2E2AB15F7C628414 7B407B3F0557FA68 CC83ECDCBB25A38C 323FBFAD731361A6 48A952DB7AE51B9C 24B7F94DD2785D37 88B1F975E0730CAF AC8CF879012AC221 BBC34DE9D7AB2058 1A9B2AC45C7ADE11 4E54D2DDB7BF5238 6EC05CFEAC7EC006 EAC8952868124D7C A76F3CB70F126F57 4A6E9A0A6315A220 A35EB048C47FFB06 2B05278ADE533E92 95D947E611B63DF5 C84A46C5716114A2 1F54FEBA77AF26D5 BB06DD920E97B059 C6E8143E6AE86EED 2C3417B9168DDAB1 FF00FAAA5C5F7FD8 6E373DAA2433131D 39367F905B66B659 9170A3DA30E75D26 776625F7770F02FC A2672DF5D89F49FB EEDEE9C19D97EA23 61B5790DF00E386B 40349A5A6D5C9532 84A122CFCB972474 DDC0FD077B23BAA5 965BFC80FC7AD166 6A5B61044A04984F 7A22E614D8FA431F E29E1B6F110707CB 1A03130670DD6C11 5E41C97BA1766C31 F3A6876037C6714E 02B4A1B22A22F4CD FEFA17062FFEAC2B E30BE2BFF1C9CA97 6ED4EDDA87068C8A 57595956A0822048 61FE07D71C08060B 6328D5076586EA45 334D0C228FB22281 DE1B25FCD64157B6 F6CBCEF85D39BF91 FCCF9D3E860F73F8 D5253F41E63428A8 BAE8B2F9BD8AFC26 67E48AEDB9C11730 41AF5CDBDCD72409 BC48A9A1FD6345AA 04513701976F0491 4E61BA8BD6C032D1

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309080359 (name+title). Key = MD5(password) = 6483fde8c798223f272838c2e6fac2fe, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7720b6e4-1df1-1fcc-9af0-f16f6889691d
  2 b3205cce-ceee-5461-90d7-42dccb71ed23
  3 959f4b92-0667-899e-9ca1-2ac02a9c73c1
  4 2531b343-ff93-89a5-a9f9-1eb052c45d22
  5 23dca812-70b2-87b7-9f17-569b8e8d0801
  6 a25717bb-af38-582c-9c94-18747fc3b598
  7 aa7be1dc-4bc9-742f-8043-3fa2a1f3ae00
  8 7abb24ca-fe7b-74d0-9f21-18147d4d7a8d
  9 fae45019-da56-6e6e-b20b-29256bfda733
 10 ae4cb2fd-5c75-0763-adc9-5eb4a6468aa4
 11 172ac58f-4879-4c80-a6c9-d25e375c8d32
 12 1c23fb55-c91f-07f9-852f-ed8db9c511c7
 13 9009e27e-5b6a-633e-9fe5-92bcccb00b60
 14 b83f1927-fc02-6b2e-a18b-2b7a449d6b6d
 15 d6004c73-4d9c-6119-9f1e-381f364c8294
 16 3e20a7d0-c21e-59f6-adaf-433853dc2c5c
 17 27f0faa6-f337-0c67-8da9-96da1c777683
 18 720018f2-32af-1bdc-b100-88186668e48c
 19 7bd276b7-e0ae-0c14-bc75-c07ced3b6f47
 20 193fcfe0-005b-88f5-9dfa-2975a4e26324

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 15888577604066650108. Exactly this sequence comes out of new Random(531).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 65 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related