201309150259 1mf7q2

explained decrypted filler

seed 770

Metadata

Post ID: 1mf7q2
Title: 201309150259 → 2013-09-15 02:59 on A858's clock
Posted (UTC): 2013-09-15 06:59:57
Timezone: UTC−4 · title 02:59 against posted 06:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309150259) = f4a6c12ab83725377583917ed4ba3bb4 (name+title)
GUIDs: 12
Filler GUID seed: new Random(770).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 62 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

602BC74B89211438 13051FCDDFEC0362 ACC10D62FA590203 B207E472FC074F2C C5A388CC71F9D76D 821414113053E5AF 9C874CCB8D8FAFA9 B0FBD2366EABAD54 B5ADA147022E0606 E44188C8678357D5 BD38B83AB0CC3CF7 6C746DA6F4A65BD4 E279C0F4CE8FA60E 7454AF9855A563FB D180D474122D3AD8 9E7676BFACB80569 AEB70E1229B1CA54 63E59FBDF849C8A8 B0293BC562F6C593 A9FC11E2BAE80B34 5C0FCB20899E58DE 0E39EB1083488092 D8B446624E386D03 418B31F539402A89 21B7E3EBEBD151D0 FAAA6AF063375305 CC3F7E686ACC5609 D65D00B07CAE1A01 D65656B813E8D04D EB7AAFFC88F008F1 1A2CC033B554D706 21BB3EE6763B1297 8AF7F7384321F31F 6FB65CC3A557DD33 E9D32DD583E984D1 0D2C7B954FEF4402 746CBC0EF093EBED 3299532915209BF0 2F41D81E735BA9F3 29071BEB8FEDAB93 EFBCDECA00EADA24 2D1B204ABF1B0374 779B625D778ADC77 67697A5F59D40A11 B11A5508D8C7DA4E 2A5F8156BD86C277 7E59AF4D32766B9E 0DA04E3BA12D0E18 957775ADA7E945F1

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309150259 (name+title). Key = MD5(password) = f4a6c12ab83725377583917ed4ba3bb4, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c974b98d-9c63-8498-b146-b0e1244af204
  2 e15c784c-0729-6ac6-853c-41e0e2f41ae6
  3 d5f28fc2-eefe-89bb-87cd-8ce8e82d59be
  4 6802c7b3-f258-8646-a802-47aee40b27a5
  5 312a1937-273b-70d6-a9bf-4c3d903b4028
  6 3b72f44b-e6ab-4b90-b8d8-d485d6fe85c0
  7 fc236902-d587-8ca1-b9b0-98a4f688669d
  8 e989491a-58af-6c85-b88e-7a2aeb4f0d36
  9 95bd6fa0-35ba-22be-99bd-8f60b2c28dbf
 10 fa953058-a0b8-1fbe-bd9d-711a5836d034
 11 c1e75c01-e78b-5793-af54-e51f304cd8dc
 12 3539cfe6-904c-58c5-b04d-1f653b373fd3

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 868874862155. Exactly this sequence comes out of new Random(770).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 62 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related