201309140759 1mdeqq

explained decrypted filler

seed 868

Metadata

Post ID: 1mdeqq
Title: 201309140759 → 2013-09-14 07:59 on A858's clock
Posted (UTC): 2013-09-14 11:59:58
Timezone: UTC−4 · title 07:59 against posted 11:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309140759) = 886a7bce23b2fb67712f440e193a9f27 (name+title)
GUIDs: 12
Filler GUID seed: new Random(868).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 43 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 2 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DDF49D388C5A36D9 CA6ED823B04CE485 3F797E8E4E934E59 672696AFCF8EFCBB 5F86C519AD86CA40 A4F0F1CF22EE3BEC F97F4F7DA1521788 9B354F15871C5002 0D108002B96EE3E9 76F51DBE457DF8B5 9BFC99C44C9D2A07 EDCBD3109A38A7C7 3BEF919667F061B4 0527625BE2FF3B50 ED3E3EBB216924BA FDFF5C256C989CBC A73C935965128023 626B8066D2668FD2 8E412CC36B954242 131A76D8DE21793E 2780F36AAB43555E 92658F1C51327ECC 9C492039F1441C27 FE02C80867516801 058B0ABEE971AF0C 077E21B623FCD1C6 23EF6CA7A212616B C43342972F12C016 D605938F3301A1C1 0E74DA7822A9ABE9 F52383613D771B8E 0B2DF92BD39A8E58 AF4871E9EAF4F978 A7B074D30F266C94 1498CB2DDCFB6796 814BD8ABBE554791 A2975598FE3B6E4A A11351E1E7AE146B DD0570A4043F85BE 8C83A59A88265E47 58B1D53472FC0B7E 91EC97F4EDA27CF9 3C873C3F441D240E 0BEB7C8EC6FA72D7 D19CD223AA6AE34B 5C9BDC25FAA5AA08 E7BE087B1DBCF7B9 C6908E58995452B9 77EE9F283AFA52CD

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309140759 (name+title). Key = MD5(password) = 886a7bce23b2fb67712f440e193a9f27, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fee9254d-5a08-1f86-a917-997cbe643459
  2 c63e7abb-2f8b-4e34-8677-eca823c1f5fe
  3 c2f2a486-4c77-4d09-b692-fb736e0dda5b
  4 803faf30-b67d-72f0-844a-54670fdd8759
  5 317245fc-9e8f-0ac8-b624-9d996afd82ee
  6 32d3f6c3-0670-0b2f-95a4-6904d14990a9
  7 8594ae49-586d-7d98-a5b8-d7263eb1d910
  8 a6dae0cc-56a5-8cd8-9d1b-52c92abcd6ab
  9 c8daf240-709e-392e-a0c0-82d2a80e4bb2
 10 8293b7a0-c833-3e2d-aff5-b7ac34d35123
 11 a1caeee1-f546-6645-8a7b-3635749b2427
 12 61636f9c-cfd5-1db9-8018-c3febaad8bf9

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 144700783361. Exactly this sequence comes out of new Random(868).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 43 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related