A858DE45F56D9BC9 archive

201307240904 1ix6ek

explained decrypted filler

seed 664

Metadata

Post ID
1ix6ek
Title
201307240904 → 2013-07-24 09:04 on A858's clock
Posted (UTC)
2013-07-24 00:05:00
Timezone
UTC+9 · title 09:04 against posted 00:05 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201307240904) = 7559dd87bc6d598ec68f03161633f64c (name+title)
GUIDs
32
Filler GUID seed
new Random(664).Next(9) ✓ verified
Run
Run 49 (seed 822,652,546) (seed)
Draw
91 · predicted N = 32 ✓
Machine boot
2013-07-10 11:27–11:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CF985CBB37E91586 AEF3C2D5F1511210 E5B296F43D2EC40A 6E8ED5C913C352FE 7BE42A5239ECE4BD 8E88784179F8FA29 451AA84139ABAACF 3B00E3D548EF02A0 62DE7E6D75B8089B A43F7FA4C1555EEC 90B563B798A61EF9 17A1665F4512C69B 4EE8EE41B59F8EF1 CA48234D3B9E1376 CB3C1E4DF1B26719 1EFDF22AC2B55CC6 65FCE769FF0D03FF DE5138DEB94E07F2 2F1566C25410F339 776DE0D50DAC1504 E55C10E309CD1AD2 1377CFFA8A588B6E 4041A572932CE6BC 5638E9266976B958 249D8A3AA25290D3 F6EE3F793D43AED4 8B95736E923B173C DD5120F0EF11310B 09105C532A3BF3E8 CAEC041000CA4A35 A5A4813A538A4B41 52EFC98698218233 AE0361C5D221C530 C9EDC658AFEA2E28 F5C49DB9D7661E0A 3EA38F3717E7B2CD 8678D25F95A50546 3A818690FC6B3830 C965094F62BB271F E18C10E516D61B7E 6F4C8D3B27D56276 12D74F53FD3D8269 C66917DB1B8714EC 63A76F3E68A9971E 2542E6D7F439E9AF 66D7C4A12D4A211A 655F6A6FC9DB08A5 CAEE2F1A1013110E 7485B2F72D33CF7F B4AA122A7BE6DD82 EF9432ECF33A60D1 EDF501D28219998E 288AB0B5ABD39D92 3CF6237C7CFF9117 79B686E185A94B5D E82D0D49DE6DAFD4 8C582D6925A60CEE E358A12031BC2DD5 CA668D56F6C47CBC E2CCB334DD293897 252B03F903E823D2 B2EF73D5908F50A6 D738ED78D74B5AFE D1D59D81527DB313 50FAC23FB4D298CA 89CAFD1F7ADF7E89 60A146BB95015428 4CB28775A4AFB229 C53C6E46B3F43C6D 976AC7D43EFA1BB9 873E5AC512F2E197 D251AE076DEF6FEA 51AE6861CCD7DBA7 15C1334AC5AA287C 3CE40463BC388C53 D1F49E62C4720ECC EDCC916D4E21C58D 994BA04C2244C227 5B9749DF67C082EE 8A581B34574C0F97 EC3531E1C1814AE0 C9984AD2F5805B8B D1CD6B952451C6D6 5B50A525286BE586 CEAB874C6B9624AA 807BC6B469285A82 A6E273734CC53B6F FC34256AD4F84911 24CD9BEE8A6875BB 6C45BE688F938939 27E2EC2E3427711C F4D95B40942E9796 16AA0F7C00D37E0B 25B2D12C907A09C1 5278672F762989C0 8E54402BA550D592 64D7F70ED16F32D0 CB2232EDE5903874 7B0D263B38573F1F 91104274420B26DD 220CA2320DD90438 327D5D50C277AA74 80125515855645DF 8CCC192B2DC6D6DD 2D83344DC76388DD 83862F25507D8442 0F9A4A2C8E31BAD4 A35B1D417FAA567B 0810B1F469DD8232 058DE8AEA41DDA8E 6F1770F27A33153B 42247F7C7B5A8414 EEC0D50D5E33299D 7B930B329D18783A 54C92988B7B3B8C0 648BF44CC6A494DD 1D9DC26B5761EBA0 A55938420450D179 309F266D8B29812C 1978113CF5C2126A CF0C69D23CB5F43E E123CF9461A337F6 FD8EC1D351674E1F 83881F9AE2D6A5AD 019A02FF8D170605 12B28185BAF810B6 557C27B03AF7B19D 2E618890AB97D592 BB79E3FA89105E79
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201307240904 (name+title). Key = MD5(password) = 7559dd87bc6d598ec68f03161633f64c, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ec1a60d0-da4d-5dce-9449-b454836791f6
  2 9131556e-9964-5d43-a5e4-2858150ddfcf
  3 7e4cf550-8a59-849c-8814-b08a05d29950
  4 f3799a94-1727-2a5e-94ab-cc2113e3a827
  5 1dfa72c0-8e09-8657-98cf-6ed20f33b19d
  6 ed0801f4-e0f5-76d4-9db4-b92796891a1e
  7 ccce1c92-7739-3a9d-b088-13534e186ab9
  8 1c73faec-9c1f-50cd-a0fb-91a86b519905
  9 9cc9f11c-e446-1f09-9431-bc46c9392db3
 10 3a7a06c0-9d86-1cd9-b467-c85c46121363
 11 069433c3-1b1a-4e27-8c05-b2d5ca90074c
 12 19f51605-aad1-78d3-a8d4-6523f3229e4a
 13 4aaaa640-1885-0fb3-876b-1b321393b077
 14 582054ea-5504-859e-a793-e23347fe6599
 15 83b15fc3-820d-6963-b8ab-27e8f5a0bbc9
 16 e67f6d62-1e8b-6ea5-818e-67b41492e9fb
 17 f4d78e1b-12bf-8628-b241-5b00955f45a2
 18 ae398607-88c9-6e17-9af7-c0b3150a9de0
 19 874380c0-fbf1-59b6-ade6-0f6574fd2a5f
 20 5ed019e0-5cb7-3143-834b-55d916963d61
 21 32a24a2a-f75b-067f-a07e-a4a29d2380f0
 22 adf8b462-a9f5-69be-a520-fd11c30b4712
 23 6f0a843e-cadf-1fb5-9526-ef0891f3923c
 24 7d5ecebb-c199-82dd-8983-4a72d92f9793
 25 0298af09-41fd-62ec-b4db-c5a70c42f7b2
 26 3cc73578-e052-55a5-8d4d-e3f424463689
 27 6c5a1646-a9bc-7f47-8868-a213bbc3339e
 28 3fd9e761-8f92-086a-8233-26cd98ad908b
 29 28f309c2-15b1-8358-9176-9134da968dc9
 30 3b15daad-0440-7344-a8ca-2e2c7ac15369
 31 1016a9fc-0ae4-2ed3-90e3-bf53158a989e
 32 86c27d74-f82b-3947-b09f-990ebcb2a908

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 55828735114708668653061865708723. Exactly this sequence comes out of new Random(664).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 91 of Run 49 (seed 822,652,546): new Random(822652546), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-07-10 11:27–11:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs