201309100959 1m385h

explained decrypted filler

seed 875

Metadata

Post ID: 1m385h
Title: 201309100959 → 2013-09-10 09:59 on A858's clock
Posted (UTC): 2013-09-10 05:59:48
Timezone: UTC+4 · title 09:59 against posted 05:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309100959) = 896c0e83789f6c4daf870311e00b63c6 (name+title)
GUIDs: 8
Filler GUID seed: new Random(875).Next(9) ✓ verified
Run: Run 52 (seed 1,430,705,843) (seed)
Draw: 83 · predicted N = 8 ✓
Machine boot: 2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 14 · 14
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E946A6D51537088A C263594E50AB23B4 C70F6767417E1072 7C32AA0CDF4635C1 D141F25E6D84CB80 249B1A35ADFE8AA8 63D4C129C90FD1E9 FFD5F5EEB28D165E AC6C85D41C896188 3207088286C286D1 1CDFBCAA80ACC84B AE6EA05DDC66800D 762B57628F0A10D3 38B3EA43EFAE927D 0B3A25A3A842BDDF 19A9E1F2E7EEA77F 4FF7E79E0CDA61E0 C21ADEBDA4684BAC 79EDB1080AFA4149 D28C47F6F50E5E4E 9889D6BD4569739E F6DD2A66B0A66CDA 5ED633033762BD42 CC452575F9FC6F49 C6BCF20A2479CD6B 9429A1324E7A68CA 67A9410AFEFE768A 7F90380813844114 EB6D41BC9EA3A134 18D1D4F7AD198C38 CC41CD4BBCE96851 CB3400C6D9BD3FC6 1F10E77CF18B6D95

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309100959 (name+title). Key = MD5(password) = 896c0e83789f6c4daf870311e00b63c6, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b89c0699-9558-7f74-9947-afd91ff8d073
  2 66ea4b65-1a4d-52ec-ba17-e3c71834a9bb
  3 dbada2eb-b3af-3b6e-a94f-d77c7f41bd17
  4 be4e2174-093d-2f92-afbd-e93ebb4ac7d0
  5 ec15555a-9c26-297d-bb0c-0703fddfdd7f
  6 3e78b5c5-fc70-1100-861f-cc9e5594b4d7
  7 3f54f37f-a786-8a3f-9c5f-6e574fec9a9f
  8 20b08e54-9b5e-3570-9d97-7b5c998afd89

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 75322183. Exactly this sequence comes out of new Random(875).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 83 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related