201309250714 1n3h2n

explained decrypted filler

seed 989

Metadata

Post ID: 1n3h2n
Title: 201309250714 → 2013-09-25 07:14 on A858's clock
Posted (UTC): 2013-09-25 11:14:59
Timezone: UTC−4 · title 07:14 against posted 11:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309250714) = f6b2e53167e4f179e673e8956c0aa9a9 (name+title)
GUIDs: 12
Filler GUID seed: new Random(989).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 135 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 9 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7A81A7205344E025 C969984372BBBDA2 1DC388D5E5568D19 A9EC9FAFB37F139A 2E41A1EBDD270147 AE0E764D3D33BF63 A17D7B113AFE6E82 182B361B804CB773 957312757E43BB0C B7EB6CFFBF6195A2 25D87482E218DCEC 4265E2ACF30AC2F4 3E080F4A494A0E98 01C2969C25F2E144 A1B9F0F34689905A 3C74B3BE165541AE 8187880B13E483C9 0D14A0DC5B7D270C 9121B32B001D6066 AAD762FC3A62AF81 F1631C087607D0F3 8135D4705E3FE1F7 82450E9452BB05A6 782767FCCEB1A101 939954D869607601 DEAC752B7DBF895F FB7C6E559EF63537 9B5C55C3CEF8F075 C89E048FA5C264E4 170BB1CE5EFC649C C0040821C50DB251 94F653FB649D3385 C8173A0818DCC309 59631FDBA1FD650A 782CE10376FDC293 6A8CC80419588489 CED157C529177B19 BE6DBEBE92BD2872 23CF7F55518AF511 1252CFD822283447 C4208BF499E26158 ADF62E15818C2E73 8E3802713A834A95 59E672904CB9751F 0E40E928E9A08984 F0B7F32BB6D6FEF4 F06CD838655CF299 60FE4B94902F52E3 B27D799131DA825D

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309250714 (name+title). Key = MD5(password) = f6b2e53167e4f179e673e8956c0aa9a9, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5a268cff-d8ad-3542-b7a5-45cfdcff2316
  2 187bb8aa-7c49-01f3-86ad-ae8f3e3a8e58
  3 c189c222-531b-0f41-bf24-30d53611e0df
  4 2c690676-3e6b-5768-8396-499c0b46db91
  5 06347084-b9da-6051-8d32-7faf6c14b443
  6 8b38abe4-41c7-73cf-ac61-1b50394b1afb
  7 adce3617-9c4d-01c8-a3da-84c5c42a9593
  8 f6892879-50e0-5573-b9dc-4a0e9e4c6289
  9 c80b1c41-92a6-3ec0-af53-dffc7cb4de62
 10 5159cafa-6c27-8fee-b69e-84c27a180122
 11 c8417f4a-d33c-8560-9cb9-bda6451839b0
 12 4836ae2d-217f-5c23-ba58-2c56c4ee8489

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 300567053885. Exactly this sequence comes out of new Random(989).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 135 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related