201309100659 1m2wsm

explained decrypted filler

seed 75

Metadata

Post ID: 1m2wsm
Title: 201309100659 → 2013-09-10 06:59 on A858's clock
Posted (UTC): 2013-09-10 02:59:48
Timezone: UTC+4 · title 06:59 against posted 02:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309100659) = 60e5b573dc1f867de9e2174cb6b754a1 (name+title)
GUIDs: 12
Filler GUID seed: new Random(75).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 82 · predicted N = 12 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 1
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C21D9B9DC6268815 92642EE8DBD92C97 16F6DC6DCF4EF603 268EC41BD0BF4261 7BFD2E1A6ADE97AA 31C579987126C98E E43FDB1F4E036F64 513F1C715585E39E 9178CF5EDFADBF7A FE24586540935BE2 A48D035BDFA121F9 A2A1FF062A80CA3A A1D3EB7D160479E0 B5CCD561FADFAAD0 413E4F2DF360D8BC 47AA70AB6ACEE6EC A8149C2EE6F7A893 DD7E58B9486839C0 93097553401124BE 43E1FA36402CAD01 ED0E53D773061099 AAFB2C64AA5F2878 65B671198A98264C 799D1553CFC79D56 59D83CB2430A1A1E E213EEB979F23D4E 2A43B114C1594D8C A00242CBF6ED3CA1 5CE9A24C8EE26F5B 4C72E7327C125D36 BAB6D2CE657A6030 2D416030DA26E8A9 EB57BCF79AC490FE FD2D9CFEE2758E0B 0A3D3E8BDE58DD39 CA86EBD2D5D667B8 DBB6C0D4E2E17564 E66BA3ABD1023276 0671109F170E9850 420B76A5F8941DCE 36C6E64216CF915E 987ADB75E19C082F F8231CA27EF45E56 4FC124C24D33905B F540F12C95839201 670BA08D62BC003C AB0BC4F6D67F0C05 78BBE89710C3C6FC 0C68AF2247F8E5DE

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309100659 (name+title). Key = MD5(password) = 60e5b573dc1f867de9e2174cb6b754a1, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d9dbce27-f698-8b5e-9eab-2ec2b391aeb7
  2 dbc64595-f364-7e97-8825-84cf7528aea4
  3 5d7890ca-c8d4-177b-839d-914385c67021
  4 1c794980-a437-5e5a-9f21-7fe2a6f7e39c
  5 aba0e490-e340-03b1-9af5-0beeaecce1bf
  6 92abc04b-f146-09de-8fa3-d49facbbdfd9
  7 e2ca61df-d4d9-45d1-827c-242f3c638108
  8 224a9f8c-5bff-09a6-8827-31b3b9633978
  9 aa87e06d-e4ec-2af8-9b69-ee7cdd8e612f
 10 99ac33d7-33f3-83f9-ae25-cedc051364b6
 11 db3956cb-c2e2-44b0-923e-4d5649ba2927
 12 73d63bd0-dfc7-0b35-a214-27d10264e66e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 871500402840. Exactly this sequence comes out of new Random(75).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 82 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related