201309171232 1mkx5f

explained decrypted filler

seed 944

Metadata

Post ID: 1mkx5f
Title: 201309171232 → 2013-09-17 12:32 on A858's clock
Posted (UTC): 2013-09-17 16:32:59
Timezone: UTC−4 · title 12:32 against posted 16:32 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309171232) = ec52052bacf6c21b34ad488a6d6c54f3 (name+title)
GUIDs: 12
Filler GUID seed: new Random(944).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 105 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 6 · 6
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

717F42AC0351902E 9F838D731F2735EB 23A1F6BCF1630F7C AEBBB1C0E7F82EA8 BC3BC803F7ABB5E5 DB847D3E2C55046E AD13BE0949688425 BE4C5CDE0BEDA24D 005B36D4EA0A4BAC 0C5949239A2929DB 584A3301865F0425 0C5F6D98208D126A D170C97C22390BE0 7D067FFF17F604AD B761AD32E0ABCE02 4E3800C24F45AC0F 1D3D0644AA66C23B AAF9BB6B51C7C595 66C4E19A50FD5470 F48227D99CC4AAC6 5AAC816AD77A8408 8398BEE865108BD6 B30AFB656004C43A 6C94EA7B9A4645AD 637B39A7EF024D82 9D468EA65B7245F6 73048608175E4E7D A5702D11B6531795 D27A325173E0AC67 967610586E5C77AE AECDF185C50835A1 5017AEA19CEA9EFD 9E91E81D4321B797 E1B6FB568D40450F 90F8B80E51CDABD5 A56A9675879E0589 F50D1D1C5569D5E4 695CA57CBF2D36E1 3D1FCF7D77306224 E11E987146F7B38D E02B47C26DDFFC13 7A5FD21E530EE17B 9E1E3ADDF989748E 47E5A8A402DF575C 6EBCF6EA5CA95AD9 DAA5EEDEF7798683 41B852CC94FEDAF8 CD64A761A3D3A3CA 2D7257868231D6FC

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309171232 (name+title). Key = MD5(password) = ec52052bacf6c21b34ad488a6d6c54f3, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 71bf1fc6-d82c-81ee-b662-582068fa10b1
  2 2e0a5c5b-9061-737b-af2e-3b431dd150d9
  3 ecbff98e-3277-51c4-b13a-4a474bf3362f
  4 ca18bbc5-e076-0db9-9857-3082309e170d
  5 f22c2791-deea-3fa3-9772-e9395e5700fe
  6 0a2eb81d-14be-46ae-b248-d0e4ab87792b
  7 cc255117-3106-7df7-a72e-fcc0b3a7746f
  8 1503b33b-6462-0c56-8181-e5aa14cca4a9
  9 45600090-9031-66f6-8732-dd8c70a9d1af
 10 a4a8e8ad-2716-3796-8f57-04a83ce82364
 11 5f3358df-a49b-6366-8a59-6d20f9e22210
 12 0320b759-d241-4715-b98f-627e88a9c7ea

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 875034706364. Exactly this sequence comes out of new Random(944).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 105 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related