201309150359 1mf9oo

explained decrypted filler

seed 792

Metadata

Post ID: 1mf9oo
Title: 201309150359 → 2013-09-15 03:59 on A858's clock
Posted (UTC): 2013-09-15 07:59:57
Timezone: UTC−4 · title 03:59 against posted 07:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309150359) = 6246fd0da1899a0284791a9c72584d9b (name+title)
GUIDs: 8
Filler GUID seed: new Random(792).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 63 · predicted N = 8 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

767EAE29B79B9357 2AA25DCC4B68D9A1 9D9D4F2D161C5E26 C819220E2A653ABA 61E3C99CF2408F10 92E46517A85DAFE2 6822E0C007513ABE CC6333F94934CE27 732AA7215CE47D7A 2DAE808DC33CB43A C7B06DC05066338A E2471D097AC7933D 8BA90B08520AFF4C 342F04DF0E25C35C F6540DBCB1A92EB8 73E69B80B757664E B38F12D944B044B5 B336F60400B357B5 DC60C6F8A8CEA3BE D9E07FD9221C899A 0A553694AE4711ED 2431CC7158863A0D BC85D03456E9F7F2 95D7930F9371B0CF 9E2C9CE2A1D9416A 223EE3EE2B82D58C 602ED318BD04E9BE 90A58EF31FE836ED 07E62D69ADA87154 AB2B8D33FCF4BD2C 2E028AF54A46280E 069232F884699C85 4D0175285A8821D1

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309150359 (name+title). Key = MD5(password) = 6246fd0da1899a0284791a9c72584d9b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fa899c6d-67a1-49f2-8b99-1b2ce4b2c744
  2 621535a8-6d68-1d12-ad94-946636966243
  3 9c1839e5-c5a0-389f-ac0a-f0cc2d3056c2
  4 d61c375f-1102-5e2f-a9dc-ad7291bceacd
  5 7a59406b-a5ad-76c9-af52-b43661fdd269
  6 31ea281c-072d-642f-9410-534fdd91ab45
  7 c90943a8-0f50-61a3-80eb-0b82f7ab2b49
  8 6bcf2ed9-2c61-6db6-98d8-0d2ddfd5b7b8

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 41357666. Exactly this sequence comes out of new Random(792).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 63 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related