201309122159 1mafdn

explained decrypted filler

seed 651

Metadata

Post ID: 1mafdn
Title: 201309122159 → 2013-09-12 21:59 on A858's clock
Posted (UTC): 2013-09-13 02:00:00
Timezone: UTC−4 · title 21:59 against posted 02:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309122159) = 6e694fd868496e5d4b3c332fac2faf9f (name+title)
GUIDs: 8
Filler GUID seed: new Random(651).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 9 · predicted N = 8 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

03D0C3DD133B7245 6D682F96259D5814 D7104430ADACB7E9 0B6B3ACE68810AC6 E15F50CDCF0B63A6 79ECD74D2FA396A1 E145003BDAA8B101 AC1758991FFA0587 149D24B96D2B6358 F5E3DA05E697D848 2618BBE99BD9BD16 65B3B7C8A9DF303A 71CBA5398E3D512E 75725DEC633AB36D 49A46BBF87679E85 9C4AFF43933F02AE 5C34E48F4E14CAD3 2ACD270924EEF0BD BE1DEC731C0EC063 B4B336C39A48A38B D5517A4F6CBA2B87 1DD46001471F1C3F 94268D5933B7F4AE 03B03FDD5E6E3D8C B844004732FF1821 94CFEE2415C28F8E 9FB8D10B2D87A9B6 E38274DFC2C8E4F8 E081656C5A93D3B1 EC3709FC51634391 548C5CB619DD6816 E653D2855339B5DE 5D87D59C5E78C033

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309122159 (name+title). Key = MD5(password) = 6e694fd868496e5d4b3c332fac2faf9f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 81f8e324-42f3-7d32-bcca-4c55e7ec0793
  2 ddea927b-2c4c-7c5f-b413-5bc016fcb19c
  3 13483c37-3550-7af5-afff-8f1083c0c382
  4 f0ed4e8a-8324-4bcf-b7cf-97f970a5fab7
  5 b9aa59fa-e819-1227-ab14-e91119f487a8
  6 33500d89-0c34-4655-ae0d-fb1227c3dacc
  7 522d64c6-3b27-5f55-86a1-0bfae0b80f71
  8 5232a6f0-7399-0b06-9533-202ef971433f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 77741450. Exactly this sequence comes out of new Random(651).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 9 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related