201309141759 1meds0

explained decrypted filler

seed 191

Metadata

Post ID: 1meds0
Title: 201309141759 → 2013-09-14 17:59 on A858's clock
Posted (UTC): 2013-09-14 21:59:57
Timezone: UTC−4 · title 17:59 against posted 21:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309141759) = 821c5f306b8042b6a76d6a9aa5782505 (name+title)
GUIDs: 12
Filler GUID seed: new Random(191).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 53 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 1
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

23117587D356C3EE 304EA31204EEE6BF 3998D906ACFC4198 5EF457EA78F288CC 5D0C6E78E61CDDB5 580AF17C24434686 9D1B9E771B3DF9C2 15912069283D55C9 5B0A28C6CA455593 119D4B5F7725D552 945C90920265C3A8 1E014DA86F0F81A1 EB8BAA95AC19CC9E A8FEF1D33FC414AE 5B6EF1EE51B725A9 F97C0DF257507417 A73560BCFCD12639 437173AAA623AA5A F8B6B473DA5482F7 580F0EDDFA754FD0 6B647E6BA06F851B D7BAB87F16E10DAF E11CE0F4B5A43D2F 0A2DF6B4EBF7E86E A8B85705A5E17283 0B7D685C4032ABFA 0897CABD5B258F15 0109942B31994DB2 BC8701979CEB95E5 979B076CBCB4540D EA3293AC8579F004 36337ABF533FCE3C AFC7A8FC250FCBD4 C8A6CEB9F8FDC84F 059B4FE781690CF0 08776BBD3B23AF96 4A95873AAB444C7A 362E558859ADE621 45823C3B9742A911 D3AF8B547086ABAA B10C74E1EC0E7010 EF23EF7A06636525 0672FA69DC226217 FE8E9F4396B4059E 06CF29F241A380B4 EB1D00A52E7CA47F 5D0A72A32825CE8E E89D840E55D6B0E6 EE76548524B6CFF6

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309141759 (name+title). Key = MD5(password) = 821c5f306b8042b6a76d6a9aa5782505, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 902b6e3f-de54-4e76-8d15-68f7c86522cb
  2 9b107ecd-d9c8-7970-be14-664cd399b034
  3 44184ed5-e187-2096-881e-b93ad7d5c526
  4 ecceec59-e664-2dd3-bd13-e1606ca08f8c
  5 2d282cea-0670-3159-84ea-b08e76db06b6
  6 3b8fa682-c64e-4c2d-9177-9ebe030fafa0
  7 e23d7458-5ceb-4d9a-b733-d839a7d582d7
  8 6abf21ae-aec3-29e3-afd4-bcbbc73d1489
  9 c7777cf8-e613-5477-b088-000ef8d30fea
 10 d55ec090-18a6-656c-b83d-f7cfb2d6791c
 11 7bf70c26-8fcf-041d-8a44-1b3ff7cbecf7
 12 e2587be0-33fd-5e81-ab06-a0470222fdf6

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 472234425605. Exactly this sequence comes out of new Random(191).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 53 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related