201309150059 1mf2tu

explained decrypted filler

seed 934

Metadata

Post ID: 1mf2tu
Title: 201309150059 → 2013-09-15 00:59 on A858's clock
Posted (UTC): 2013-09-15 04:59:57
Timezone: UTC−4 · title 00:59 against posted 04:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309150059) = d92a8236c96a76e2ac753ac0e6d91988 (name+title)
GUIDs: 12
Filler GUID seed: new Random(934).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 60 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C250C05D6BCC831B 8FD93ED9F5F040FB CA0B73F76B9CDD82 5269778CC4BFAEFA D904FD17034AE2E8 D329E3D6462990A5 A173E00442900547 B9B45CBBC933A2A6 CACDF2869F59D935 F3F9BCBFB28DAA0C 3DD0E3AAF3A1AE9B DAE4DC9D47ED2D15 4A2D2B6D3C198E30 3F0EC74EDAA71FBC 615D5B5072D437C8 E2D8237E7396AE69 A1CEE99830BC304A 374877BAF75F1C3F 84BD8FC3CF3471D7 FF32D2DC5F347794 9F4AC0A9E59920F2 FA088B41B1907365 D82B1EA9F49C5662 1E9EFCA8B07A1568 AA7B93A6FCFB5C6C 8D98D611FFCCB21A 76C3334437F28895 4D6723FE5CF545BD A67145BA2E95F3EC FD095921ECDF8A1A 5753E6AE4401E6B3 1AA27284BE22311C 939F1F05ABB726D6 62ED7EC884D10ACD D4E60C1D70F07D5F 5398370898DF97AC 98F9480616241BFD 9B144E536045ACD0 5A5837E0BD738319 E0838F1124299F0F D22415AAC89C074D 7987887225CC3048 E32086076AE762C2 A25758960EB44AB1 C1123D914DF7D950 685EBC41E6616BDE 059A80F8D47AB9D4 48D38A4F539D99BC 89697B05763013AC

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309150059 (name+title). Key = MD5(password) = d92a8236c96a76e2ac753ac0e6d91988, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cef4f7a7-233c-60ab-95eb-b5fb36df47b3
  2 2b548a99-bd1b-735d-8135-edf081baff0d
  3 8ca6803b-8fa1-5873-b585-03cc8a661e61
  4 80555f95-7243-8bbe-8046-9ba730570d1e
  5 82eed800-1df2-8b1d-9df2-391e8e602c1d
  6 c439d575-cf50-72af-a377-69b5f3386437
  7 dc3ceda6-dbbe-359c-8d8b-b3c3649c87f0
  8 5f2270f8-debc-0196-a06b-300fe6864c5d
  9 c5ae37ba-728b-49e9-87b6-0feeb2ef730b
 10 d2dc7be3-2e0a-6584-b837-7cbf15a517a6
 11 acc8dbf0-5aa2-3a5f-9504-f2187f74ebdf
 12 d951df3a-149d-5bc1-b66c-471fd283d83a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 675887304635. Exactly this sequence comes out of new Random(934).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 60 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related