201309130659 1mb3yg

explained decrypted filler

seed 184

Metadata

Post ID: 1mb3yg
Title: 201309130659 → 2013-09-13 06:59 on A858's clock
Posted (UTC): 2013-09-13 10:59:59
Timezone: UTC−4 · title 06:59 against posted 10:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309130659) = cb13171138e0d1f43cd31b26728171e5 (name+title)
GUIDs: 8
Filler GUID seed: new Random(184).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 18 · predicted N = 8 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2355881CD4FF7E94 61B33380DFC9F27F B8F316A5E0568C82 E24B0DA58142C83D 545B56DCB0783C88 6C457725BBC5D811 4AA034D431B7773F 060D35803B8E4BC3 9796DB33F80E7350 6D7AC0977B3F7F12 45A94F10BE66211D 47FC99C3E61407FF EC7F5D2D307A2822 6285347F569C88F4 FB0A378CBFB0EB2D CAB7396BEBF24EBB E74D275E88340178 F3033E0945B3FB6D 5510356025796CF6 E66944C04FB3A173 549DF67245DC59E9 48DBF2B9A30B6522 484CA22AE2C835C9 0F2366041377DB5E 565C8933E51777C7 3991CC9203C993F2 D934E166AACD038A 43CB018BB9A1C253 85FB11FBA8DC5701 15D28BD9FFA4E10D 3A156CB8BCD9B105 A1E92511B15CE379 24AC21A44F64D875

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309130659 (name+title). Key = MD5(password) = cb13171138e0d1f43cd31b26728171e5, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 969d0ed0-3247-7a37-9934-d2ffd20cc8a1
  2 4bbb67a6-210c-7eda-bf16-84cf36a3973c
  3 c0b40d25-9f72-3244-877f-41941f247c0f
  4 68a10b55-0f0a-7898-8ac8-d8b81997b8fb
  5 7f452d9c-abd8-2179-a2f1-ad9df4529fa7
  6 e80daf40-5b5f-36b6-bf49-8068c7b77eba
  7 54ffba07-4ec6-3690-9085-c7aac9ab0d33
  8 a707221c-4216-64ff-89a1-e745c21cedd5

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 77372336. Exactly this sequence comes out of new Random(184).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 18 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related