201309141959 1melam

explained decrypted filler

seed 218

Metadata

Post ID: 1melam
Title: 201309141959 → 2013-09-14 19:59 on A858's clock
Posted (UTC): 2013-09-14 23:59:57
Timezone: UTC−4 · title 19:59 against posted 23:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309141959) = 506b8b62311f05fa2aad28172387d64b (name+title)
GUIDs: 8
Filler GUID seed: new Random(218).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 55 · predicted N = 8 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1ECA6B26DCE5E1A1 0382207E9D643095 45DF062042CD182D B5B5A34BAA77501C 6B7B815A534DAF84 C68F86AE43C793BF 527AAF148FDA5FB2 13F55BEB5B1CDA67 1341644B0EDFDCE1 6771849EC1C47851 68D5BF1042129208 4AAAC279E78FF46E C9BB25726F9771FC EE04601AE16E21FF 0B3FED1DC77F3B68 7DB8AA4215FA091C D428E47168B1D595 8E656A0B0DADE2B7 6FE0BFF2C72AD8BD 07F703E998B85CD8 E2902276E19A1CED 8969D578392142C6 035E56AAD43669AF DD5AF6277A5BDDF2 EDFA9FF132D42440 0C86BE2EE9F2A73A 7F95680DC5520996 6A12A626DE21DED2 2A4CFC59456F9525 00081798B692157F A7A19FE9B6089E78 EF560A7A4B3D433F 5A2AD6BA378FA9B8

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309141959 (name+title). Key = MD5(password) = 506b8b62311f05fa2aad28172387d64b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3536c33f-217a-5e2f-8c4f-b207a193b85b
  2 64942030-7f31-7328-b81e-3465ff6ad1d2
  3 62741a84-f417-1267-83e1-828f6eecd4e1
  4 da9f6c38-5220-0630-9e55-5415bcde9574
  5 f4ec4253-e08b-5ea6-a7ed-f27aed129a04
  6 019cbb45-db82-028c-845d-f10e7c0784b5
  7 dde292e3-d246-5f41-baa0-3155e3a30002
  8 b63774e7-ff90-71c6-b700-2a7609f9cdda

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 57105057. Exactly this sequence comes out of new Random(218).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 55 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related