201309121759 1m9xnh

explained decrypted filler

seed 859

Metadata

Post ID: 1m9xnh
Title: 201309121759 → 2013-09-12 17:59 on A858's clock
Posted (UTC): 2013-09-12 22:00:00
Timezone: UTC−4 · title 17:59 against posted 22:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309121759) = 171596e3eb719709f37dafc290cc7494 (name+title)
GUIDs: 12
Filler GUID seed: new Random(859).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 5 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

57F94ECF9D80DB0A 5804F1107D2B930C D213B3850324E56D 478F29120784417C 30475A5FA2D8DC05 62BA5E59B957BA4A 373E7170221C5E40 4D28AB5E06B056A9 210F18A3CA79990B AD4C0BC7AB69C075 B64A746D7981331D 8EFD0C94BFB25816 75CA64D8FAFDD3A6 95F17B7C8E53976F F2ED874662227934 08995F6FD1B6C361 B5E7E3FD88016433 1D6314A5F12B3D82 012B08BF8D26DC73 C1B0F8D3A1D7F05A ABC89371F1091355 35E32AB10F66474A A6E734B3DDB99FB9 D31578CD01042EB5 81DE7B05C45E42A7 2A5467B45905D700 44992A24B736BB35 A3E5CEA32BEF097F 07969456BB6D505E 9CA1940362BC1AB4 3D4C8306D184FA2D 15BE2AF7A9982F10 A43AC211C15D6975 933539C7DF79FFF0 89812E0BB0214665 1B849B8C1C768C11 9E97412AC88D7060 E480F99F17412784 D438C79B321F0075 9C717F71E5170EAF A03A9387D568CE96 431459CA9999D0E4 6F00BCC9339F7C20 1F19F8F19BAC7147 FD5F17611AB07783 5C79DAC9FCE6ABAE E8A7458C0311EA9F 8FFFBF7B62E28964 1BA4952CAE449522

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309121759 (name+title). Key = MD5(password) = 171596e3eb719709f37dafc290cc7494, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 216338c2-9967-4e23-9819-85b03ce0b827
  2 4bea9b3a-a883-7366-8411-303770796a3f
  3 2d22ca8a-6ebe-1676-a6fb-c8cdfcb397af
  4 7b6a8a97-7f4d-886f-8f0a-b6ccdf48f3ed
  5 9353fa12-7681-0004-8e88-6b766b50d3cf
  6 8a4942a0-0a55-2823-84b8-bb1913f074fa
  7 19f16899-6153-76f3-83e7-4bdb1a719836
  8 bcf846aa-e0c5-3e15-ab85-57e78d27da37
  9 e9c55a27-6f64-2312-93a7-1142458a81f7
 10 7a3d76ea-7eb9-0a61-a79d-17731fb508a2
 11 7b6b49f4-e36d-139d-8109-86a2dc3ed322
 12 051d5538-2161-0efd-82d5-27b99994df5b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 471802732010. Exactly this sequence comes out of new Random(859).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 5 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related