201310021914 1nm83k

explained decrypted filler

3DES(name+title) ECB, 8 GUIDs, seed 396

Metadata

Post ID: 1nm83k
Title: 201310021914 → 2013-10-02 19:14 on A858's clock
Posted (UTC): 2013-10-02 23:14:52
Timezone: UTC−4 · title 19:14 against posted 23:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 528 hex characters · 264 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201310021914) = a7512eaa2f9880abc82f5dab39ce9549 (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 8
Filler GUID seed: new Random(396).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 150 · predicted N = 8 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 1
Tags: automated (decryptable)2013Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

266480901ECCC0B8 F0CAC91C7F41DD62 EACD24BA946EE3E3 B143472BB9C01755 581266D60F186CDE AD4F4001A97E3859 FDE3EF88CFD456AF 80AB0EDA54506515 77884B8466B6F534 D264F06876210527 EDA9A49992AE6860 25176C54DF030D44 95D259FD5C5E91FD E12388A58DF8017E 03D1599B5EA98CA7 6BBC0EC8BBC2156C DBA5F996CDBEBE10 441712AE52755454 49F215323162EC23 5CF30592FE486BD9 695D33A304498740 09426576F980B000 8EC90EB9EDF94C21 5E898E11DDCA0B81 CCF6AA55EDAD237C 6BD1AA407776FFF1 BE58BCE5E10429C3 3FE02461F9B4811A 5F3991E38972E655 ED1EEFB19257A957 1BD1C84F1EA43F96 C56384AE82E45026 273AB23EE68E0207

Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201310021914 (name+title). Key = MD5(password) = a7512eaa2f9880abc82f5dab39ce9549, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 83ef651e-82ce-5f5c-b852-f9569f0f42c9
  2 0a4f9f1b-a4d1-0212-ac23-773c17d1e13a
  3 c59397da-8ccc-5024-a19e-de15dd842995
  4 35304e06-0bd5-0610-afba-b650c295207c
  5 470ce302-35a7-8049-8704-9b11e92fcec2
  6 ed51651a-efe0-5e2c-ac01-bd798efb96e7
  7 4ccedcf1-0ac0-322a-9bd0-c1def201d30f
  8 b6620d72-6197-061e-a395-bc1a3fb73ae0

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 50508530. Exactly this sequence comes out of new Random(396).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 150 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 8; the post has N = 8 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related