201309151459 1mg3xc

explained decrypted filler

seed 153

Metadata

Post ID: 1mg3xc
Title: 201309151459 → 2013-09-15 14:59 on A858's clock
Posted (UTC): 2013-09-15 18:59:56
Timezone: UTC−4 · title 14:59 against posted 18:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309151459) = ab89a8e3e56cdc49330b24a4de987c21 (name+title)
GUIDs: 12
Filler GUID seed: new Random(153).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 74 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B94EEB949655D9F2 D23A322D88756264 0B7A345B17D238DE 731C798EFCB2BAB0 11CE8FE0B3851A5D 0F782C77E3454CF0 C415EFC78592CA0A F5B4F1491D2F32A8 BBD7CFFA056BBDA2 394A24898BD90C6A 10AAFFE6B3BE48D1 F77FBE89E39D3586 6F143BDBBA7A9267 4326B713440C924F 7E800AD85E7B1634 4B9BBFE60DF714AE F5419871E14A4B9F 855BF4B47553A54C DDA7DC326AA71C14 A41E368087436BCF 80D847A18A0398BF 1A4E0825E3CDE287 EB0FF6DDAFB1AE8F 06346D709288BF89 F0E76C46A68E0FAC 88B5C5FB22CB5E63 10B3BB0346EE0AF8 D577BB6E1D026B63 E88A6174801A14F5 6CD841FFFD20A89B B721344D8F2D8E62 5188594E5152A941 7EF997D1C3C888BB 93E7F57CA0EA38AC 9776526F810F26F6 152AAAFDC099EAEE D243880D33FE80EC 0B4E6FC61679F1B9 86EF659A3A112C65 892BA471632C907A 871679EC06945D2B C18E7E767B633511 27A01907B49AA252 29DC0D2737B1BD35 3F303D7A90A127D1 8ED7E21210EAB42C 50D9CE98CC5060FD F6D7E0F5DCF48745 22B52162C41ABF97

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309151459 (name+title). Key = MD5(password) = ab89a8e3e56cdc49330b24a4de987c21, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6f5756b0-20c3-57c9-a535-4ae1a6e283c6
  2 65ad24d2-e2dd-6a1e-a643-70c1acc670eb
  3 5840172c-cd56-631c-a162-1451dabc1e3e
  4 e2b87f4d-99c3-1b01-928f-afeea320ca24
  5 32cf1d33-1ada-28e8-a413-36b85a242595
  6 13be328c-80d4-2e4a-9565-97ce6d4b0577
  7 e63dc39c-fcde-4f88-9f36-abb668d75178
  8 58a8a68a-f1b4-16a8-a7cc-a91ece52431b
  9 d33c2a94-a1f6-858a-9d1d-74332e2dd8a5
 10 3fdf8946-009b-6dd7-a17e-7145005c1213
 11 aa7a6471-f294-0d47-8c42-091e096e5e6c
 12 61fc73e2-6645-8582-bb2f-be939f8c5d2e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 566122418608. Exactly this sequence comes out of new Random(153).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 74 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related