201309130959 1mbcgp

explained decrypted filler

seed 991

Metadata

Post ID: 1mbcgp
Title: 201309130959 → 2013-09-13 09:59 on A858's clock
Posted (UTC): 2013-09-13 13:59:59
Timezone: UTC−4 · title 09:59 against posted 13:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 1,552 hex characters · 776 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309130959) = 25a45036d606a394e2d86d5cd5ae21ce (name+title)
GUIDs: 24
Filler GUID seed: new Random(991).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 21 · predicted N = 24 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

47C7C0122845147B 895BDE0817705CD1 FF4FD2F7FA963E30 C60DF38686C82F6D 9E98F6BEF0C894A7 556B61011F6EFA0C 7B3BBDDE0A267BB1 DF716FB5268D3DFB B6BF7451809BAEA0 38816223BCF00C63 9CEF4A383DD423D3 36EF49F97A152156 1875C11365C63394 2540571FA355BDD5 A88E12859FD51A5E 045FB4411714A73D AEBF116125E7BC90 EB8D59BEC416996D 6543D97DF2608EEB 0AF087E8503C4A31 8C571808131E9DDE 9ED7CE141E9499BB BFC06BAAC5E180CC 073A26688CBEE232 B4C75B06B714C626 D7595A7F636E7244 5564A5725D7901A3 7066ED86A414CB88 0DD4367122B5618E A1819357475C0143 C95EB64F30A90157 40D19623A67626DF 218825BE226523DA 3295B400919273DB 993A25FA43BE5B95 BB0CD25D41191A92 4A3E49268EEE2975 B1B0D84612BC4295 99D947AE392F2BAC 9CD84025AD6E61C3 6169F57F9CB8F54D 4A3327236EF07EF8 55CDB17DA60F0B09 6810B23059206AB2 E10804986DB4AB2C 75FAEF15288B82ED 653DB32DC0E797FC BB1205D2F2182D99 718749CB9575D3EF 2246AE389D32683A 9CBEAACFEEEBC99D 8D2B358D9A96E1B3 1B31B80691A9FFD0 8555419C18AA5D0E 07425746B51470C6 27D22AEE9B6DE53E 41560F3B05705F49 E9D371373A9F59E8 DE89ECFEC865FA8D CD62BD09B5930039 AB8DC80FFC835253 FF75B37C61F3558A C76403417AD39D65 386D30EAA964CE32 94A94FD8C5E0F168 F86002CE6670C3C5 8C4405FA608254C2 15C12C5B3B283A4E 76D78480428B2304 C2AB8F5C53E4B6F0 6BD84F4C2AFC5E66 9A67D61DC999833D 989CE67EF83F47B0 82C1BA1B4878B52C 683486F02597321F A77BA43809DCBE9C 87C634EEB743B079 F9CD092DF83436B6 B7808C85001BEC7D 98C2BABA0A120855 28C582C1E1C8C04C 90EB8B58378B6108 1EC6F4937406A653 193F30C119158D03 6D3D31E5D64C6B19 205715CDB6F12339 48710675A1A4F81F 4E64B7B108F3B2FF AB0C5E61D2E6C4A7 063D44463E61710F 99C081E9CF4E5512 05B9E20BD5A0E450 BDA181E37BAE706C FEBDBB3DF5F81A91 5A5AA0DE3DDABFE8 AB408DE89DA86320 47B6E397638BEDEF

Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309130959 (name+title). Key = MD5(password) = 25a45036d606a394e2d86d5cd5ae21ce, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 912571d6-ae85-4f84-a35a-1f55054922d9
  2 c2159c01-0b54-5e96-b962-6a33535c5c9d
  3 6cde57ba-eb9a-40fc-a5d9-ec4fff94c4cd
  4 5f64780d-ed82-0474-a6d5-9b957528d9b1
  5 3d6ad9f0-4a3f-55d5-804e-b31cbbefb66f
  6 7100eeaa-936f-5a3e-8f87-26eb54e6e3d3
  7 8ff390a6-1e48-8eb2-965e-f644f9b80694
  8 ae5131eb-089f-5086-ade0-1c5c8b42822f
  9 8917b1b7-548e-5ded-accb-ea5682210288
 10 8210780c-812e-6964-baa8-48dc6059bb45
 11 2c87da41-2567-3447-a5ec-21555b8d8ed7
 12 660efefe-6e26-1f44-82ad-49cd5b769fc4
 13 600d77f8-efc8-841f-9178-cc140dc1184a
 14 c436c72e-6c08-0b7c-977d-b8983b20ef87
 15 24d99e21-ac71-5b03-99ee-3b4af9d4b388
 16 3674aaed-e4d6-8c99-9984-936244a50508
 17 c2bbc634-f46f-3dc2-8e70-bfeac7515cd4
 18 dc5880a7-3d00-33fb-8360-98e6b9a7dcbb
 19 acb8a2a7-83ad-4c92-ae8c-0ce919e6e20e
 20 392c4edb-25de-01ee-85cc-9928fe7376b3
 21 a8282801-3bfc-43ae-85eb-53a51ec2da91
 22 a3c0100f-3a1e-872d-9584-fca5f173fcd7
 23 1d5ce9b9-70ca-44ef-ab74-2a09ecb61c43
 24 fdbb2ee7-c278-24ee-97cc-5cec1c142774

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 454055855631805833404842. Exactly this sequence comes out of new Random(991).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 21 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related