A858DE45F56D9BC9 archive

201209200745 105t9g

explained decrypted filler

seed 313

Metadata

Post ID
105t9g
Title
201209200745 → 2012-09-20 07:45 on A858's clock
Posted (UTC)
2012-09-19 22:45:08
Timezone
UTC+9 · title 07:45 against posted 22:45 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
656 hex characters · 328 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209200745) = b0d702cf72c6ba44c703e7736a020752 (name+title)
GUIDs
10
Filler GUID seed
new Random(313).Next(9) ✓ verified
Run
Run 32 (seed 945,377,703) (seed)
Draw
8 · predicted N = 10 ✓
Machine boot
2012-09-08 22:08–22:23 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

25A2BC7F06083985 FC3D227EBE777E04 D8306862C87E9996 532B12B5EF809E93 EF4380DF9696B431 DD1CDE93C093DFE4 F377DC7D94B6FB12 39A5D8D13FCA537E AC49E21889222CEE 693C56442B97DDC7 77940ACEC0346A26 0BF19F8B579423C3 9C09A19A5BB68F83 D4283476FB421CA1 E4AC378676E9845B 317ECF87D98D8B41 D58A459BC000F140 48585352C64AA49A BBD1E1FBF48A54E7 36025EE1670FDF52 DA51E471A8E575CB 591F35DABD113C8F B7230BE75F944DCD 24E0BCD7F7539205 FDA65814DC72ADE7 7CC78BC0BF199D25 29F140F20A541BA9 C0277D3A4FF081FC 745D42404BCB8D94 5B408149539BBAA1 FA8AD23B9419DEB7 C7AB379BE482E9DF 3ED7FB6E822B6B8C 9AEF2C07BC483B57 9690008D79FAD8D5 B22FF3A23C0A1928 1B6F788B832DC519 ECF33F20F1F21FDE 4338C5602CD9AD5F FB7429B0E3AA72D0 74CB6933E888AADD
  • Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209200745 (name+title). Key = MD5(password) = b0d702cf72c6ba44c703e7736a020752, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 495a9f08-d6e5-2048-b0de-c819a8bde8f8
  2 4dd3bff4-2c06-5312-9a7f-cd945807f581
  3 1fcc204d-68a3-4a8f-a0a3-73e7cdf5e6bd
  4 e42e705d-d3b5-39df-a481-d58d9a08cdf2
  5 4085843b-3a10-4659-a762-c4ad919ac75d
  6 55ca8146-6333-0068-bd73-02e2b11bd6c9
  7 58dba574-1851-1f56-bf53-829d5ece4edd
  8 96760ea1-3ec0-43c0-80e5-8a08c48a0c2b
  9 915ec1d0-dc35-6e9b-b75e-8c1485dfa14c
 10 420b7d2b-70e3-6097-80cc-70d73b974201

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2543401466. Exactly this sequence comes out of new Random(313).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 8 of Run 32 (seed 945,377,703): new Random(945377703), Next(8,64) per post. The RNG predicts N = 10; the post has N = 10 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-08 22:08–22:23).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs