201309080659 1ly9bl

explained decrypted filler

seed 372

Metadata

Post ID: 1ly9bl
Title: 201309080659 → 2013-09-08 06:59 on A858's clock
Posted (UTC): 2013-09-08 02:59:50
Timezone: UTC+4 · title 06:59 against posted 02:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309080659) = 082c78e481cc3383be3e1b29edfc395f (name+title)
GUIDs: 12
Filler GUID seed: new Random(372).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 66 · predicted N = 12 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

55C81A0F89257A5F 843E2013ACF280E8 E1E7A64E53965EF8 A90D6CC600D79567 5E4C4BE05ABD28A1 9E4C10189B3AC2B2 611066F099EA65DD F8A234686C65202D C7B0E115468CA537 517CA3C0042D9407 B17BEC931FB577D8 0B4FD0B3B9C4DAA1 84F8699937CB9FD4 323F7ADE24C4B7E1 7F2A575148ABB0EA 5ABF38996F1744CF 35FA0AC2CBE4C129 78894DA730F9482A DD7D65960EB7F5A8 481622007AB8B663 7B3C3B51BCDD9FE2 2F4F7047E82B3D6E 0046A909C34458C7 DD0D7BB0B58D2C09 29F815650975738F 0AD22A76CB7B459D 5E079ADA4D128F3F 8C5BB9396D20FB99 A732AC83C65BAC0B 7A4A49B7F3A59D83 417780522D50447D 002219DB821A97F3 82EFE291B7309253 935A0AB789A232FC 2E4383BAC449874A 9BAE5DF0CD40893F F7ABAF1430BDBEAA 7B8394E800577E1F E8173FC4D0A6CC87 88C9B2323436CB2F A70D4C1E42B76865 FD263FB0BF340B56 DCB18337BF428452 9F9154DA55916BD3 E1A487BC23A19894 39F73BE75D4A3372 6156CA1140E2AD4E 140CBB9DA00AFCD2 D5C7D2652EFE462A

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309080659 (name+title). Key = MD5(password) = 082c78e481cc3383be3e1b29edfc395f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 343db3a6-166f-0bd7-a235-37209b135047
  2 571b3709-e63d-8d3a-a0b1-d535e622a7ad
  3 82269dcf-4120-7001-a066-612686e32ca7
  4 ab545be0-a788-8fe5-890d-80e3afe1bccb
  5 1aac46c2-2e35-1504-9d23-739aa4923280
  6 c631923c-73fe-57fa-9e25-eee4726cfb79
  7 9b9b2c2e-48b1-5e7e-8f99-6ee384829991
  8 c5a01008-5250-01e6-8cc4-4170b4b1abba
  9 5eccdec4-3c5c-07a8-beb9-6488c6c9b407
 10 39b9f6d8-ebad-4ded-b766-a81630e93d57
 11 c2fad39a-58a4-3c2f-975d-ee669368c8bc
 12 41461f36-2bdc-88cc-821f-9a46d7c0e9d1

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 087815500438. Exactly this sequence comes out of new Random(372).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 66 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related