201309082159 1lzch4

explained decrypted filler

seed 739

Metadata

Post ID: 1lzch4
Title: 201309082159 → 2013-09-08 21:59 on A858's clock
Posted (UTC): 2013-09-08 17:59:50
Timezone: UTC+4 · title 21:59 against posted 17:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,296 hex characters · 648 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309082159) = 8e4f93b4dd44f4021dc9371bafc79bec (name+title)
GUIDs: 20
Filler GUID seed: new Random(739).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 71 · predicted N = 20 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 2
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8CCE50D42A929195 0496CAF82E11C20B D5E5A86E929C5BCC 6A8AA41448657B26 A8C885F28F244B12 B126D83863CE04E4 695680803E7AEB2C D41F2F3427B88834 9339DB1BB75F719B 1D09FF0707C3D084 5548B7CFCCC42553 7DA21BCB3376BBCE B4E9061FD4E16F84 58DF4352A9FEA664 525326EE9BAA0912 D02139F681B6FB6F 32B770CEC4F178E3 C9AC610BB6D75846 5B538E1D95F991B7 D242DDE8B5B723FB 789567899CF5521E 6DC8AD7EC7B5C0FA A70516A1F69FB473 4BB1C5B56661C869 F8F8BFADEABF1C7B 5D3BC366AE88A4F3 6E40682CF51F4FEA 45A72E379B8A54FD A9258392DBD6A073 33AC3186D4B888E8 0C83999209C18F10 1929C8261CE24B0F 805AC2821A92C03A 411BFA304D2D3D69 2640802ACDFFA4F1 91040C67ED5EC59D B1EAA69D35C3A1A4 8E16FFE6239706AB 3017B92F5DF9DCE4 9D27C0547A0617AD 612C48F089F1586C CABA004463A3ECD4 8F3428A6C71C1749 D30565CFD347F27D 10A1B6CEDA57925A A34BE836DC6012AD F9BF91794C979C9D 6CF0D846D84180B5 A4C77F6A34DA8A55 904BE333B803B2E6 6FDC9D63188F3DC2 078CE4C0200B413A 1FCDDD69D7F322BD B5A54DE252CD726F 843EB662F413CA4F 792496AD9D095DA5 8848004A0F2D635B 59F93B32569C2F41 7FFF998954F243D4 FB6338ECC230B2F9 EA3A95E2364CD24A 8C4D074D8AFF5795 B6E3A02AF7B1722A BC7E76F9E69CD22E 8DBA20ADA09D30B9 20CA31594EC5053D 6D50E5C83CE097B9 77A6EA766BC8889B 92DA1005DA3A53A1 C73BF7443173FC71 094B77318E3A2CCE A2D848D736B78EA1 D78C77122B05B4AB CE5FB7764C56874D 3309B97C98C6860A 7826B4EBF72F91E2 E83CF87707092EC9 32824073F1329FDB 5F76D0EFF6A08FCC DF0BE5129B51F4CF 442E802A22C007F3

Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309082159 (name+title). Key = MD5(password) = 8e4f93b4dd44f4021dc9371bafc79bec, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 48eb1a15-1205-7a5b-8341-b53bf7d95803
  2 00d88cf7-5493-5e4d-b19a-b98584a17e4c
  3 12282219-080a-266b-b580-4d5714c84be4
  4 757361ef-2a59-2cf4-bc21-5bcfe2db11a3
  5 9ffe946c-5456-74e5-951e-5e156d3fe32b
  6 20b68e23-9c4a-31ab-a984-bef96edb27fc
  7 239af847-6def-057e-8bee-e2bb6278c77e
  8 31dc0539-e6c5-17e0-9f7c-3c38a9352381
  9 61898cd3-18e8-348b-8368-7d320aa56ae5
 10 03acba92-ad61-7dc7-b3c1-2d63b5f2f373
 11 378bda38-6db1-60a2-957a-a6211e8b227f
 12 6806095c-c64e-3680-a040-ee7f702f21fc
 13 78e06b37-4267-5253-b922-c7c914cb8095
 14 cf3b956a-8693-8ea5-ae26-4829e555d3cb
 15 78f64897-0ee1-258f-95a7-b21c8ee8dc82
 16 6a85d219-dd9b-4d6a-a1cc-131fd992377a
 17 5709e0ea-0461-4f4d-8809-2f56564468cd
 18 d74ca9b5-d51c-137c-ac73-de6199f8b396
 19 5f30d8df-f055-6116-b093-733f80175d17
 20 a738ae78-6b98-4d8f-a0a9-5ca6aedf91b7

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 75227301376358244164. Exactly this sequence comes out of new Random(739).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 71 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related