201309170032 1mjx4u

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 634

Metadata

Post ID: 1mjx4u
Title: 201309170032 → 2013-09-17 00:32 on A858's clock
Posted (UTC): 2013-09-17 04:33:00
Timezone: UTC−4 · title 00:32 against posted 04:33 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309170032) = 404886ba3770cd31e79a3314910c39c8 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(634).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 103 · predicted N = 8 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F316A83841CDCE48 E9FA6E1BBA7F8862 193A17427FCA9CC5 D6CDDF462EFAD0BD 0CBF328561C3352A CE792C6638741FD3 708C23006FB064C2 B76AF4659B1B9113 F60F6F675F73A728 E53263CE0E55ED0F DECEE3985213D5AD 50EB6C58D623E235 030C323A68ABC9BF E9CC6A1C794331D7 5FE0FA9C8980A2DE 64C214F90BE472AB F7BEB7FB3240D3DB F947BB28081FEDD5 F386DDAC0CC0F85B 023FDEBD1F470CC9 DBC0F12BA1C30905 BD412352FA9FE4F6 929FE372A55CC151 27E02243614F6E27 7EE110AB58BF866E 7AEFD96727367EEF B45F0F71A9C7F64F 5FE3C1ED0659B11D DAD0068F05BAD53F 79A8CF3DA4E721F0 8BF42DA2C5543B46 365A0D94421EBF18 4F77AB0402131F11

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309170032 (name+title). Key = MD5(password) = 404886ba3770cd31e79a3314910c39c8, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 85e27124-2fab-8ac7-a8eb-25517e4441b5
  2 206d39c3-f484-7b91-949b-c9347303d4d1
  3 ecdb8677-a87b-8dc5-83e3-790327e1861c
  4 a3d836c4-b863-75de-97dc-5c721aaabad1
  5 43e1e9bf-4b1f-4308-a764-052c3134cb62
  6 b2c687ba-1074-53af-a657-bb4ff783f79e
  7 c149ad1c-2240-8d2d-8957-3a5fdeda008d
  8 ed837868-7b3e-45c4-842b-0028e908841a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 87874584. Exactly this sequence comes out of new Random(634).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 103 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related