A858DE45F56D9BC9 archive

201309010359 1lhn7t

explained decrypted filler

seed 3

Metadata

Post ID
1lhn7t
Title
201309010359 → 2013-09-01 03:59 on A858's clock
Posted (UTC)
2013-08-31 23:59:59
Timezone
UTC+4 · title 03:59 against posted 23:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309010359) = 8b8eb25c02170844fe45b65b4f03b8e7 (name+title)
GUIDs
16
Filler GUID seed
new Random(3).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
9 · predicted N = 16 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 3
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E52DCADB63A8AA8D A7F00F520A2E8775 B43EFD968C66E2B6 0970D63FE6E00A0D 569EDF489E5F0D93 24B8532F90D96C1E FD846FC2C9ECD759 8CCCACA25691AAD4 64A25FE891818E08 F56335B750F4CFCA 7761AB4420F88193 B3FAF96F087974DD 7A7F862E4116F1B9 094FF0F30E3EF01C 66675FC606FD9DBE 9C59D06D953C2912 ABC52FEB87F9713C 16709BDCD28AFD0F 63DCCFDABB715B2B F47FC5192F961B12 3789D270BFC7098D E3EA46255E27CF7B 3131A3C74221237E 0156B193DFE71A9C B0D5F27928A2FADA F1B883E3ECE93B91 AE5D540E15F147D7 BB40CD9D438BC4EC 376620D35544864E AF2D21B34FE843E7 A20D01809F67ECCC 38BCE5F4E043B926 C47D4CC0D82F8383 32D6093A7E2AA881 242B716022C97724 F4D082847856F123 2A8D3B989ED2C1F6 0A8712A8022A25FA 3FC734FEC8D93F62 370E3129006CA481 1F472A4A21E66A7D C045AAD5099913E7 ED56C2CFB0248D8B BBF516D5405273F7 449BE3E1C12C3DB3 7E3BBA60650FC515 215B55D3B2CEAF53 11730A400E1B2728 44B9782D96B781C8 28A680EC4B0E63FD 270C82FF0DED8DDE C279CBC523ABD0A4 15F09916FA59E54B E95A8CB63219F1F6 EAF3F77E03270B48 9029F09B8498774A FBC951A423685204 192FBC1B99554088 D4A1063CB9BA745E 1C9E08D15A49B5E8 2C7FFEC34EF45987 1CB06249B66B0A6C DD15AB3CEB84D624 BD49C022C26E8132 54D50BD1241423CF
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309010359 (name+title). Key = MD5(password) = 8b8eb25c02170844fe45b65b4f03b8e7, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e40f2292-1a3b-2016-a41d-4cb00851d718
  2 f3dfe028-350c-6a34-9b92-da5396ef7e23
  3 8d6852fa-1e16-76bf-972a-3189c3fafbb7
  4 74576a3d-a856-174b-b98e-1d1638cb53ef
  5 004906b7-a881-5c16-ad71-b24508398eb2
  6 0ecbf09d-b520-1c19-9a74-56c850ba5d12
  7 881f16d4-d62a-210d-b911-d5c54dd0b7ae
  8 372f13e9-99a8-823b-8265-d055f62ae342
  9 1032ddde-ff96-39b7-b3aa-108f0ef0f1f6
 10 16b4a2e5-6f08-3393-a8d0-f42a3c2a5115
 11 d65eccd3-7f71-46c6-88f5-81c3e107ff98
 12 94583ad7-45cc-73ac-8659-e7f42a172a79
 13 594b634f-cb3f-60bc-b406-b8ca500ca7a7
 14 5f8276c9-8225-0e91-ab25-e8af20bbcc42
 15 d70a6659-7575-07ba-a8ac-69b9aa166b73
 16 97bf0859-42b6-8ae4-a4dd-9b8426ee616f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2671512833476008. Exactly this sequence comes out of new Random(3).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 9 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs