201309132359 1mcyep

explained decrypted filler

seed 189

Metadata

Post ID: 1mcyep
Title: 201309132359 → 2013-09-13 23:59 on A858's clock
Posted (UTC): 2013-09-14 03:59:58
Timezone: UTC−4 · title 23:59 against posted 03:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309132359) = 493d5ccfd22e5587e6a5dded1b65765f (name+title)
GUIDs: 12
Filler GUID seed: new Random(189).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 35 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D3717124B539EA59 D8CC1E544CF499A1 C103FE562A3CD550 EED28E77B8053722 FFA3C3DB60B2E472 6DABB7F322B77E75 C68F070F37E1BF1E 9E246E87B70246EC 6E30DD2CA8BD6D24 F3ACCB7A0DBC2725 3E7C3EA633D9267A 6632493D34004877 942F04C5C5189147 4FFB864DC77EA9B4 053EED3E54BBFD2D EA470E1BA1010BF4 7E4E406777F177FA E51092437802D3CC 2F4D41D128DD0030 476AE59C8EE9696E 0200C7342C3591BD 87461E996666C6BB 8C4BB41B4EAF0CEE 3441D13DD5BB1CE8 DD6AAEF02A6A8558 73214D597E0411A8 915ECBC1B6024ECD 293FFA4FA90FE1C5 517E9E6146ABABF5 B0056FF97E746141 D422267314DAADD7 EA0D609863370FE9 2CE7EF687B97A77B 21F03D8836B756EB CEAF8FD6051C40D5 89E151A9280211B9 973F272C527D3E5F E49A412B07D42CD9 96C19426F54A80BD A22230B5344EF3DF 690B56BC33B2475D F63BADFBA28AC6D6 65BCC47BEF72E6A1 00E860B42E4E0162 4BA14169F37A9A3B BAD8BDE035EC0191 687022AD8342B4D6 197F2DB02147376D 0E88CE18E0F0AF45

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309132359 (name+title). Key = MD5(password) = 493d5ccfd22e5587e6a5dded1b65765f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 11157456-114e-4db0-9efe-ba5e0aad78c3
  2 17cd674f-b631-204a-b547-6695645b1ca1
  3 c64f6bf1-4416-774f-968f-e37eed34ddec
  4 00495819-d508-8b32-aa47-7834ed282274
  5 7343eb79-e0dc-4fde-813e-4907f31926f6
  6 eb3ed0c7-208c-69e0-a4ba-4be7d2e6396e
  7 3463743d-c494-5724-aedf-93a607fabde9
  8 89062019-f9dd-212c-94a0-3dd1a55e6b3f
  9 945e765b-cfd8-315a-84c3-0ff983adf16a
 10 d4ee2c9d-e6f9-8d74-8fa1-5e24f5d234a0
 11 2fa7e5af-9f8c-41d7-bc95-2a37d862baeb
 12 647867c1-5b92-0cf6-a5e3-2074be28554f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 427846523840. Exactly this sequence comes out of new Random(189).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 35 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related