201309152359 1mh9nk

explained decrypted filler

seed 717

Metadata

Post ID: 1mh9nk
Title: 201309152359 → 2013-09-15 23:59 on A858's clock
Posted (UTC): 2013-09-16 03:59:56
Timezone: UTC−4 · title 23:59 against posted 03:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309152359) = 5934eb36765e05f5a6b306c45e8d987b (name+title)
GUIDs: 12
Filler GUID seed: new Random(717).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 83 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1222CF998133A935 841A8C61B8B81F8C BC772C52B4FA2F66 9EE7D05435B14007 733BFE7363EC1C6E 4B687FD93CCDD31F CDC8924B514BE416 F360F0389E066DBB 2BFE8D49262C7C0B 208DFF4F1FC33F28 1D9466A24EEBEB82 A21C0AD1FBF2A245 B5EDA53E3434882B 59917D03B0EDF22C 4B299EC19D63394B 055CABDA81156F3E 42A15E05809220E3 9615682B5A098BF5 3B934CD4C03A6A97 EB6E642B0102F745 68D9198E52DB61E2 23FA7462EBA8C588 62787E1332CA0AFA 33E46A5BA1472160 26A5B10674692C55 3D4D16032ACCED24 F98C8C0A9141A524 6C7EF260534A7677 589BC2EB50FB0DEF A53E4F626A0959F6 E8FC218492294386 902B26C8CE98FAE3 E4FD3E5DC2A7F8B6 E139A65CE7168551 CD25313C81926F3D 4EF41AE950FD28AF D1202B454DA94656 898BA803FDA6A16A 9564F82DB3FD76CF 65CC8C6799B313E5 480DCEC0295FDA3C 17A435C82EBBD122 D42A3157A2F01914 35635B017D19E227 503071C29BDC2C22 3BFE4CD5283A05CB 844A54A9CB8698F9 D701CC217A9D737F 2672E0A1682868EA

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309152359 (name+title). Key = MD5(password) = 5934eb36765e05f5a6b306c45e8d987b, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c06d9a3d-4282-2d2f-867a-713c59b5fae3
  2 a62e889a-599c-10d3-9ad7-fbee32c03df6
  3 2ec1c845-1f95-8a11-8ba0-f7e99afcb8c6
  4 6f0f6d13-e0e1-5b00-842b-4e1c742b8a11
  5 749bed4c-528b-80a7-8f26-4d3b7b318055
  6 a54601b2-c2d1-18ba-b98c-a0bc019cd59f
  7 7de2e0e1-7fbf-16e3-9ad3-33ef86a900ac
  8 039a6834-8c0a-165b-80fe-0dd21885363b
  9 e828a63e-f98f-6949-9a89-9579641c98d0
 10 66d8cbf8-b6c7-626c-888a-e0c7ff14cf79
 11 a9ea7f3e-0fae-4f05-ab0a-a66a652a61d1
 12 fefb930b-5f61-2eda-8492-c9c18631f80b

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 218581116642. Exactly this sequence comes out of new Random(717).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 83 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related