201309122359 1mangc

explained decrypted filler

seed 506

Metadata

Post ID: 1mangc
Title: 201309122359 → 2013-09-12 23:59 on A858's clock
Posted (UTC): 2013-09-13 04:00:00
Timezone: UTC−4 · title 23:59 against posted 04:00 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309122359) = f3b8ca4722080ffb57a49d5cce20b103 (name+title)
GUIDs: 12
Filler GUID seed: new Random(506).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 11 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DA91B2C0BA8A747E 042007DF340B41C1 1FBB668F93F6BAC6 2E7225E3E6AC69ED 02A2FFCA862E2FEE 930332868B191CBD DA06E2646329BF38 A986FD4B17775425 3E00FCEF966A9A2B 6BB79A2A923E05A8 8C1C9886221B2B12 2F94BB29229AF05B 03366AAE83B04257 87FE2B7A89CB401B 4E25359317573E8B 2D3D8DDA89584521 FACF14563E0D7C7E 76AA725DC6A580EE 4D33D8E17D13D022 B79161FDFF33E51D A576DD7BCD9A7E88 F2CF94F9E05E5264 86A58DD7E4C61E15 1D7AC869BC1C71BB AE9BF50CD6CF921F 4AC0BDA16D665B0D 08156A6F7BD02678 F74508C15653F6A5 92E4262034B6C896 57A1A5D0E1B7A570 E0B085843E9B739A D3C74E1D06FB3856 46A1EC9E7D4B1F28 68250819188567FF AECE714038ABDC9F 57961094CD4C6690 53E32EF738CA704F 280046B7DF6BDB11 BFB0FFC632BA3AC7 4434B5551AD30123 865FBE53A6F7C111 816351E91B55AE0C 4AD6F3D0554CB07A 0327E01E16546AFA 81B2CA25331DD6C7 034BE5F86F67B607 A2CBE664CBB50349 6CBD6B1C6C7D5EB3 05BE11322E4DD2A0

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309122359 (name+title). Key = MD5(password) = f3b8ca4722080ffb57a49d5cce20b103, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2d445fdb-602e-0a93-b308-3b484b6171bb
  2 fa249c70-382e-2147-b846-451019404936
  3 19d33c1e-38fa-4f83-be1e-1dcfe3c2ea25
  4 01bb7737-5491-57a9-9f63-787782bb746e
  5 55df3c6f-a8dd-5986-a892-949d340fc8a1
  6 d153d2fa-d5cf-64ed-87de-61d0b9db4414
  7 de555924-4707-5bd5-8443-09205afc81fe
  8 e93cef42-a106-2357-884e-21db19a908de
  9 67e28ac1-eabc-5103-9446-15ca7ff51ce0
 10 3a6da410-69f8-7904-8918-17178fd10166
 11 a64e240e-2dc0-05c1-be09-ec39366d8f57
 12 e066fd6d-6cf4-4213-a194-325221285826

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 024556525704. Exactly this sequence comes out of new Random(506).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 11 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related