201309241914 1n2ba5

explained decrypted filler

seed 672

Metadata

Post ID: 1n2ba5
Title: 201309241914 → 2013-09-24 19:14 on A858's clock
Posted (UTC): 2013-09-24 23:14:59
Timezone: UTC−4 · title 19:14 against posted 23:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 272 hex characters · 136 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309241914) = ef6152fa13a384a4fb2178f7fa1cca6e (name+title)
GUIDs: 4
Filler GUID seed: new Random(672).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 134 · predicted N = 4 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 3 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3E26102CB4DA21A9 5446060C1A148B94 EF4DC8C2F6049EF5 5749A2C8D8BF997B 71B3CE929368D589 0754D80B59580E40 CC5987A2DEC488FF DC5BF100356CEE21 90F0C39CA99E27EE A46CC5A1C96A4155 A0E964F7493588F7 C3379EC936792ED6 B35EB0845E0DB808 7459A0962CA4E468 83909C27B5A8D881 933664FFC595D9AA A4295885529B71A6

Read the ciphertext. Strip whitespace: 272 hex characters = 136 bytes = 17 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309241914 (name+title). Key = MD5(password) = ef6152fa13a384a4fb2178f7fa1cca6e, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 4 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f60326ad-a3ad-7ad0-a274-b7349a82638a
  2 2e45239a-7997-8f9f-9b5a-4d81d8d275ed
  3 0ac20244-c5b0-407c-8198-24d4533fa1a8
  4 9b8de597-e56c-818d-a453-f3ecc320a68a

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7848. Exactly this sequence comes out of new Random(672).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 134 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 4; the post has N = 4 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related