201309150659 1mfeg4

explained decrypted filler

seed 594

Metadata

Post ID: 1mfeg4
Title: 201309150659 → 2013-09-15 06:59 on A858's clock
Posted (UTC): 2013-09-15 10:59:57
Timezone: UTC−4 · title 06:59 against posted 10:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309150659) = 5701fe9a7ddf5e10a9452e97d25eecca (name+title)
GUIDs: 12
Filler GUID seed: new Random(594).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 66 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 8 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4D57B56D6CFCFC27 1AF3E8CB44149C5B B3B7070B7189E2BE F5E8BDA512DA830B 2977B17C6F6A67FD D3526947D93436CC F5B2C71403EAF057 54C81B0C0F0FDB5B B804E3FECB67BF22 5EB56D0FD51C9F45 081FA4AE6FEABD5D 2E7180238E4BC928 AD8C0A848227BE31 9939F706B9795899 0F7AC5474760DE10 A10277D3817E8732 D9544AA5424BD943 C91F38C28B07D881 0B33726122DB2F0D CC2EACC0603308F6 D8F9F858476B57F0 41268500A7C9F3A6 CF098084BD85A986 1AA963466832576D 8628A4BAA2AE3723 238DFB14128C139C 0923669710D296DD 807001DC74BFCD7B F02EA3031DC04CAE 7BC528F5F9DBD705 89E32C39D569BE05 ED41F89F2821C20D 3368EEE799557A9B 8454E3F75B7589AB 1AC0AD0FDED75CC7 91EDC91915C6C57E C35A07429D50C28D E25A6FB5F98A4563 22AB3F842901CFBE D741E3CD73FA4FCE EFF336E31FFF4751 ABF7C7095437C56F 70F05B9377225683 8FD54CC534FB5AFF F20EBAB59889B8AC F5E74ACC1EE9C287 41C47E05BC1A445E 5DBCB651C70DC8B9 A99BDF63DBE2FB2C

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309150659 (name+title). Key = MD5(password) = 5701fe9a7ddf5e10a9452e97d25eecca, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cc55297f-d02b-0c81-b189-23ec62adca15
  2 fe8478ec-10f9-066d-a1c4-530741d264f9
  3 a07dac7f-14b4-80e2-9188-04078ee97647
  4 3064899e-483d-3ec0-bec2-906f061068cd
  5 23e34815-a9e2-3310-8541-c6f9de0ab5be
  6 884d05c8-b383-56dd-a6e0-2994b2cb8342
  7 7bc1fe16-5c92-088a-9491-9cac574e45c6
  8 6d62f3e8-19b5-3429-beaa-b10475a4a885
  9 2c79b2e6-0664-4e3a-b768-2b916392eac8
 10 0f425333-a486-2bca-8d51-3d086913d3ac
 11 18934808-ffe0-8af3-b25e-986bd104be19
 12 042444e4-5491-1a11-b477-e6a0c274955f

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 008335034281. Exactly this sequence comes out of new Random(594).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 66 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related