201310030714 1nnawy

explained decrypted filler

seed 800

Metadata

Post ID: 1nnawy
Title: 201310030714 → 2013-10-03 07:14 on A858's clock
Posted (UTC): 2013-10-03 11:14:54
Timezone: UTC−4 · title 07:14 against posted 11:14 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 784 hex characters · 392 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201310030714) = 0af8e402fb473d64981919f3232712a1 (name+title)
GUIDs: 12
Filler GUID seed: new Random(800).Next(9) ✓ verified
Run: Run 53 (seed 26,950,390) (seed)
Draw: 151 · predicted N = 12 ✓
Machine boot: 2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources: community-archive, arctic-shift · body from community-archive
Links: Reddit · Arctic Shift · JSON
Score · comments: 1 · 0
Tags: automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

118B5C74603D342D EE2927E4B425CF1A 0176C59F6A6E5D39 6C1AB6499327A731 A62572891046C8A2 DBD491641A3C078A 005DD573D060A5A0 CFC1A11C24678CBC DDABE10873294042 5A38890658E279E0 1989A94795E07B8F E0D4352459372CAE A265C71FEE470FB7 4BCF36D05C34AD97 9E119C18A08A4338 74C1332A68F7B390 37439059C176025A 5AF554355CD6CED3 C0FA0138B4416290 B8EAAF141594583B 626F09600981DA9F 1E0FDCDB3812D38D 09225D820B89515F F12402197246BFC9 6BA9DE3916988701 98441D235A551DA2 72B6F886A998A78D CC4048E6F327E4DC 5D3A198A8B82FE51 0B758AD92C21F046 700A063673FC3DAD DEB16B99B27A0DD4 D66643822A34B8DF EE881D29D87BDD17 5286F9D174DFDB5E 984703573899354B 8625741596DA7231 95656DAABCB19B4A 284E232B2DD45F12 FAB22C874D55D76D 33EF471963A36016 08CAC832F6F3360B CAFE0854E5CBA6FE CA7FD77631BAA0E0 65C34E5F760103A6 3FD68B8634859343 AAF9091028B4A16F A4BFF50EDC0DCAF8 B971469195307390

Read the ciphertext. Strip whitespace: 784 hex characters = 392 bytes = 49 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201310030714 (name+title). Key = MD5(password) = 0af8e402fb473d64981919f3232712a1, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 11e7f776-8c9f-5525-a04b-c0723cb8d3b7
  2 89af6f7a-4e8a-49ff-b500-9d085b61c390
  3 a4f6c111-a26a-853b-8993-300f3217a56b
  4 a96a9a60-a92b-2506-a21d-b6ecab596cd2
  5 1e6cc842-aa18-357c-9785-6d2995cf3879
  6 552d1cda-5233-615f-be81-84e5f6e7a664
  7 ad4ad1fe-e2b7-3794-9bb0-2f020c1767c0
  8 c7ac114e-22e6-7730-8258-90c35b7e88fe
  9 77d9b589-4167-88e3-8b5c-c9b8cf454494
 10 ff419ba0-e559-21ca-82f4-9f1b110c9e69
 11 8383f2d6-2dfe-666f-b4f5-8e545241b71b
 12 c46fc25a-0195-03b0-9a23-df9976c96f78

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 548236378260. Exactly this sequence comes out of new Random(800).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 151 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 12; the post has N = 12 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related