201309291914 1nejhk

explained decrypted filler

seed 681

Metadata

Post ID: 1nejhk
Title: 201309291914 → 2013-09-29 19:14 on A858's clock
Posted (UTC): 2013-09-29 23:14:55
Timezone: UTC−4 · title 19:14 against posted 23:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201309291914) = 1e6192a21af70b10b88426459854fcb2 (name+title)
GUIDs: 8
Filler GUID seed: new Random(681).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 144 · predicted N = 8 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 7 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AA7487D5D2459484 EB74E43171A047DA E011290FEB8D1828 EEF4C0CE8D99BD8A E10C9BACC8B72FFB F2298EEEAA196E8D 66EE9BFF5D83978A 543987D314ADE372 3EA184A6EEF7CB3D 5AD5F2F1E8E05544 E763224D44A6F3E3 58E0C8E8B5221297 49D2B8A4EE62A428 1F61024437721EA9 A04E98B5EAAA0989 535CBD61E1010181 B386C1A8428F93F0 0FC9ED823293B615 9CA5330E7B07DC97 4DE97A9FA06F467F F3179E1A03991F40 C24FA3F209563479 AF52B101E53E4A72 3DC5860111E6BFEF 2D53758AB940993A 39893DFB10912178 835DF122252CD523 AE4413BB25304D5E 006959E3A4850CD7 913B3ACF65CAFC9C 43F8C488A523DB78 1DFF1AD1A00E640D 536DE38551A9DC4A

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201309291914 (name+title). Key = MD5(password) = 1e6192a21af70b10b88426459854fcb2, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6e8a8045-ac23-4094-8a1e-a1ece6bb05a8
  2 cb7f8148-dedd-57f5-90ef-960daf32da96
  3 7c6ef921-1a4f-7ca6-b148-e9074c9504e7
  4 ff98d234-6c69-8535-a3ff-f2d620172a36
  5 4e1d4929-2c32-69fc-aae5-816c583c7516
  6 9b2e2e1b-9215-6d3d-9ba4-2f4962f0230a
  7 c4f27912-318d-0332-a340-784b4d38a8f0
  8 8cd2c531-e827-04ac-b20d-529fe4273ecc

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 45786600. Exactly this sequence comes out of new Random(681).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 144 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related