A858DE45F56D9BC9 archive

201309010659 1lhxll

explained decrypted filler

seed 800

Metadata

Post ID
1lhxll
Title
201309010659 → 2013-09-01 06:59 on A858's clock
Posted (UTC)
2013-09-01 02:59:59
Timezone
UTC+4 · title 06:59 against posted 02:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309010659) = 8e28b32e54ed98e03703b892d3f64dec (name+title)
GUIDs
16
Filler GUID seed
new Random(800).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
10 · predicted N = 16 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

17E0933DE08343E2 2647EC6CD596F48C 89F99697A8702A63 ABD0AD95418204C4 A17DAD71173C01C9 F7BD26F7A3882E50 FE621DC60BF15739 49585593196BAED1 FA33019780DBC292 4D4D46F1B0196A9F ED8479A12553DF4A 8EB1FD5963C3F52D 6912C00B06D05E79 5C60DEE5DF4E52C9 C9248E4DE7463CA3 10104E5718145155 86F59FC2CF74D861 A0E204C671087607 CD9945B980708BEF DE650887337530B9 1D5A744555758248 98A4FBEA78732DC3 793731A33296BB08 86D9AE73EDF27C47 BF810412672ED74F 0A441A6B2BAB1377 16E9A0F17A51A2E5 820159D5B15CF4D6 1A9FEA408AD108FC E5CF92FE9D7E49F3 EB8C0AE5648665B0 33A22E068F5E448E 2131FDAF84DF1BB8 E8B49A326BD1B849 29D9B4C3BBAB90B3 2A7DC3E59D72F12E 171BB3E6E9ED5DAA 7E0C229608451CD4 529EA8038A2F32AC 6E90C0EC6397A099 1F4B368B3AEDB3F0 39A1B175AA8CDBF2 CC51AEC0A83D9488 1EC5D7A0CC19E6E2 3F2E68F7E32FF8FF AE2686B2460DE5CB 6A9DB9F58BB7BFDF DABB7A9C2A2846A5 0A4708FF1A9AFDE2 1FCA01CCC775D7FC D9ED4F5038FCABDE 21658DB55E03A955 8AF6687D0FD08D74 9459D7A3071041CA D685B5C978AF2B43 3E30898AABA51146 DD8D2C5DEB1FA60B BC8E19BAD5BA2906 5BEE539178757339 21BC9163AF363B0F 09C691427126861B BFDCC6D7CB6A0E5E 420125181CC19D08 BC890111E3884C11 88EFCE6688EC4BD7
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309010659 (name+title). Key = MD5(password) = 8e28b32e54ed98e03703b892d3f64dec, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b1b3eb80-0d95-558b-abeb-134eae4a44f7
  2 11b2a039-12eb-41b0-84b5-f0bebdc38d18
  3 708d4349-4b5c-8a57-a447-c070d4c0446e
  4 8b0a28a2-4518-2f5d-b25b-2a0348af5c38
  5 e0c16ebe-f107-336e-939b-8ff896a07357
  6 e56c9f61-cb66-6763-9dd2-0c1e60ee24de
  7 cdd5f2fa-06b1-38d5-b80c-5a8c830d695a
  8 29b012e5-5e3c-78c6-ad68-7d8ca55174b4
  9 f8e57853-b087-85fc-94e3-bde6d5497f1c
 10 78028b66-58bf-2728-bf21-12ddcb956d38
 11 6f29d5cb-949c-69f5-856b-162579860fb9
 12 cde248f5-bbc2-0643-9a20-43a33d0bdfdd
 13 98228a1e-bd10-5898-8bef-4ba7e9f273d4
 14 7bb96a85-0b2f-6ed8-9ec9-c7f62805fea9
 15 e1eeee1a-7938-88e8-be5f-98cfcf420f63
 16 f4412673-bbb5-5923-89a7-e125cf8e81d1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5482363782605685. Exactly this sequence comes out of new Random(800).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 10 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs