A858DE45F56D9BC9 archive

201308090906 1k0er1

explained decrypted filler

seed 78

Metadata

Post ID
1k0er1
Title
201308090906 → 2013-08-09 09:06 on A858's clock
Posted (UTC)
2013-08-09 06:06:56
Timezone
UTC+3 · title 09:06 against posted 06:06 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201308090906) = ed1713d0b470b3f3caee6c5afe617075 (name+title)
GUIDs
32
Filler GUID seed
new Random(78).Next(9) ✓ verified
Run
Run 50 (seed 2,278,890) (seed)
Draw
27 · predicted N = 32 ✓
Machine boot
2013-08-05 20:29–23:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FBFA8E16945A0D1C 01B68379B6295582 56B12E01DDC09F1A F3B7B28CF20513D0 D42A9024E6061A54 93E0B97C811275B5 160A8A813D0ECDE0 538C2E967030E596 288E24AB558B9AF4 CDAAB3720995A727 31A27BD398119167 7A0ED0F4EFB18539 6D324C94FAE1A2E1 D59444C3A2BE1658 B2A5FD2AEC597110 F2CCBB503660B9C5 7BB41234D85D8D34 D4070BD34A392C97 DB63C60624A2D6E0 DB2EBC4F1320B342 DACB418836F8FFB5 79119E584B7C8E38 628F5C36C2A9B632 A27F2A6E0FB5076F EECA31EAD6789A7F B2BDF47907051E28 7ECEF10FCBD86D36 5FC827D896E2013D 9ABAB42EA440849B D450AC5C00C927DB 5130C2BD1A6BD64C 9DE20D3BFDCA99DB 6E6FFAB3E152578E 2CD857CC7318E23D B33374CE61185D18 DBFFF2ED90B4831D EF36ACF14CC0BD9E 87400B2084342B4B CC0C870FEE554630 65E3D6BC71BAD49C EB92FBDE8D2F10A1 680EA9E0E4EE1EB7 CD9ACC369FB737A9 3D8A2287C93E95ED 8F591ECB1DD8237F 8F4163768BF280A1 2FA2429D9603F8F9 B2C91A9EEAAEFDBA BC6F1D71C2D0F650 A8DED2B86D430E5B 149606C1BADD4F08 39D401B6588BCA3F 365FC2C5D4498629 4228DF47A8CD62FC 30E6498CFFF4DB70 23759A24EB17DF7D 163558ADA6C2CE8B 75D8A22B539D6195 7BCB1B8474E983FB 5CE8387A31D9D4A1 7BC46626D8424A34 CB249E2238B01B73 31A080182DF0134A AFE97D877711EB40 D8C509EE5F4E413C 83D321E75702AE0F FDF4510F82699CBC 922B39C3CA395060 C21F98BD17AAD469 2DCBCDE4F0F3B564 D6AF1AEBE293115A 0B19CAACB2E484C9 AD56F4DF569CFA0E B7DE0BCA58B2BC5A 0BCE686FE2E5F0C6 CE932A85A56F20FF 77E1749049608227 5E1671BD479A8C7F 5E73FD6C118300B9 B0BD10C25B460D39 1C7A539A2C92A631 5A95CD5D4794FEBB 476501F0AD7D7F42 8A91A511AB229A6C 0C9D24FE8EFD5786 2D178C11E87502E7 12EA19CDC7FFFC92 32D1E8968BB9DB77 9D7CD0E708CFBEE3 B6C9931FF15DE60A C398E8CE4E895290 FF7F4BADFFEC4F9B DC20FF9C0C23B1B9 53E5419E43AAFE61 D9CD6097CEA84EF7 D116B66B8682988E 3A13AA9AA0140BD7 436BD354328C1953 E0F3E3F190CD3C14 8A269D90EFD1FB9A E3FC93BD5EE833F4 915DA4150BFBFDBB 872EB3F96361B0E7 CB210F81D231504A 630B5A2EC203E09B FED07FF94EE2CC15 2B2DF9747563699E 914DEA87BE51B92D F1D3A8CFADE007DE 69445FFD73E0679E AF4105DD2EA735FC 4D4F04A86CC71CF6 B50A59A97D8BE171 0C210E9BC2E4ACE2 95E8992970CC8705 5362208C3E4FE40D 780DA9DF63E07935 A5F0D4274C580D19 148DACEA1CDBAC9C 092BB0D386731411 6E2130B115F5AC0A D2C469A8673CEDB5 686CF1385BED31DD C36EAB450280C275 CDC74F44E38C77AE 4B60F820EEEA9A5E 08F26B20AC2AF446 9E121925EE229BAC D1DD24026ACC0B0A
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201308090906 (name+title). Key = MD5(password) = ed1713d0b470b3f3caee6c5afe617075, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 195043b7-6f1b-4cd7-b7f4-806fabe02b85
  2 2b36ee5c-fbfc-607d-9456-51aa84f44190
  3 cc2db256-9f76-2411-a03a-9ff92ccda2f8
  4 7554f7e7-536e-1c8a-9aab-6beb8e85aaf5
  5 5f1e7282-08d4-3eaf-8ab0-65ed0c045b06
  6 db48a5e2-e027-6bfb-ad1b-713c661fc1d5
  7 14043a5b-7afd-7355-8cb1-7860b3e87b6f
  8 dec903b6-6359-57cf-808b-5b563b0fdafc
  9 3e9ec61f-a2ab-5743-b1b8-70b50493d23f
 10 c4b6d729-a8c1-07ae-a01a-0896bd347a2c
 11 09bc6182-2867-6900-9d46-030ad5788428
 12 371c12af-f1d3-3871-8e4f-42defae74792
 13 c29fa206-50b9-2a27-bae9-f79e238e316f
 14 43975e81-e2a6-0523-9ee9-d9af30bf264f
 15 73e802e2-5703-54d8-8bd0-cc0a2f46c433
 16 6fc2d18c-2dcb-6d07-ab1a-906e99c28201
 17 b6239cd2-7894-5896-bca5-a9ea74db64e1
 18 284a0eac-010d-3815-8618-66c260b60610
 19 baf9a7cf-88a1-7dc7-b5f2-cf7b6eb1cd28
 20 46b70f8c-a4c0-4d1d-919b-f162e04ee3c8
 21 6beffe5a-2048-1a1a-9d3f-daa2a2a2c6db
 22 a0829944-ea0d-8543-a0ee-4d6bdf4d8f39
 23 bc17c3c5-4130-11a0-82e7-89972e83b6be
 24 9e982f7d-e995-209c-9dbf-2f542b36f423
 25 e013e22a-a300-38b5-a4a4-5c6fe9031e0a
 26 240f2a63-687a-63e7-b899-7dc78b53014b
 27 4af036e1-6ae0-8dc4-bf83-c9a28f6180c4
 28 c793baa2-3dfa-01cf-bcee-0a798b51408b
 29 2b6bfc5c-da47-0a2e-8ae5-7a23e26626eb
 30 2103623d-f961-8c4a-b106-de1059e6760c
 31 98e1d9f4-3793-8ce2-b6d1-56a12f5297dd
 32 0cd28946-44c8-888c-9d67-1be7b2f4c8a5

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 46213675506320565374181236800888. Exactly this sequence comes out of new Random(78).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 27 of Run 50 (seed 2,278,890): new Random(2278890), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-05 20:29–23:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs