201309160659 1mhs76

explained decrypted filler

seed 335

Metadata

Post ID: 1mhs76
Title: 201309160659 → 2013-09-16 06:59 on A858's clock
Posted (UTC): 2013-09-16 10:59:55
Timezone: UTC−4 · title 06:59 against posted 10:59 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309160659) = c29b4e72c1673ee6d3aea2d480a97963 (name+title)
GUIDs: 8
Filler GUID seed: new Random(335).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 90 · predicted N = 8 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6BD3214C61CFA651 07A30214AB744FA5 1F1F5A6BD28549DA 2A37B27B96033626 6BC6720E53486F9B AD10A5D6C91373ED 53E04421B2BD8B73 4D08615B71BC9E9A 134BA7A71051A60D A4DB1EA9CA56F848 E683051C8C5AF26E D369F8A20FB14FEA 071D5B28FBF47BA9 DDE09D4D80362626 EA80670C8FEE92F4 58C57FD3A50B35BB B14C0F93B5EAECFB 8D4AAF06EC23EBF4 0D2B69F20B6B7A77 15CDFC9E0DC2AB5A AB2E38D495AF8F95 854BA97778A4DC9A 363F10F4431378EF 441EB3CAC1B6C951 91B6A9208A314089 C4AA25329FC704F6 18C3CB4AF9C1C2AF 4D9366C6DE9D54A5 A34015A1D4D72F3A 2D3672AF55C7202F 497EC9E36F787294 30EFB11D1320D12A B7F4A0B9B2C11690

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309160659 (name+title). Key = MD5(password) = c29b4e72c1673ee6d3aea2d480a97963, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e4d5115c-f975-6cba-bf20-15d9e3e4933d
  2 31b63086-9a9a-179c-827d-2dad266cfd45
  3 90198178-50c7-8bb3-a53d-d6ebe90a5b02
  4 b678d30f-248e-0f55-ba89-4b5697a00012
  5 16294019-8a75-4372-9f97-df7759683284
  6 c9e83fae-27ab-2209-bf1d-2a69ebbdbf98
  7 c568d2e9-9b2c-0555-b9ec-840d7a1aa372
  8 42d6ecd7-9af6-4a52-9def-c252a8f1765e

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 61804204. Exactly this sequence comes out of new Random(335).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 90 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related