A858DE45F56D9BC9 archive

201309011259 1licig

explained decrypted filler

seed 464

Metadata

Post ID
1licig
Title
201309011259 → 2013-09-01 12:59 on A858's clock
Posted (UTC)
2013-09-01 08:59:59
Timezone
UTC+4 · title 12:59 against posted 08:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309011259) = b9c6006dc62539c6192a7860e4872965 (name+title)
GUIDs
16
Filler GUID seed
new Random(464).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
12 · predicted N = 16 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

77B665689C36468F 12C692AD38982CB8 4DD3ED9683CBEE6C A4B926CD832FBEF2 8A2F0C324EC3B30C 010D9971E9C97720 D46533124D8223E7 7289B09C59C7E1B3 F415674B9B766A66 95FC931E57947B31 DFBB6DCE477B0AA6 04692141F57A58E2 1813140DC8210902 34120D4AA44489AB F8610899038F336E A0525E7598D4D49C C27D7186EED0A012 E392C58E9481F0FD 7029F7E4B990FCFF 4F63B11AA5952F25 B1754F3EE3501600 1DD307901D0A4B78 8C8EC7A94953A4E4 310B61A63734AA5D 1909481C304DD137 EE70168324F2B68E DBBD6CEA7899602F 61954622A91A846B 76DAAB723DD37AB2 C5E2A4C4E4553272 5B166B96BC50A5A8 FF92F06D8FCD2B07 1E4C7D532BBDE3CD 6F0A9B1744BF1F89 05E1F4E7EADDB5C3 276DA5A382547568 94FBDE3EE8A4C31E 42FEA9DFC3D384DA ED670FAE0D7E620B E56D92D1777319E9 E0C0D76022273B8E 29EBA0F797F9E85E 55CD2B834C2CF208 D838E3B332E8E549 5F5DCCC71535AB67 91DCAB08A296DC0B 6AC2ADF58798B824 11F00D1B89BFE161 F2FDC17A19C77D6D 0244AB9B2A113B08 ECACBE47315EF3FB 8250508E2408C1EC AB320EA56D51E28C 0CDDEE6159D893D0 0A6FDD1A76B9D4CE CD11B35D9DBB46B2 DD4A432D2AF13CCA 9190D94003AF18D5 AFED3DAB89FD8E06 D1FABD0CFC4C4408 2FEE35669DB71B41 88E4F40FCB4A85DC 0AB3696F8240C028 5979AD4F5CABBB4E 3E6E90CEB23ED47A
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309011259 (name+title). Key = MD5(password) = b9c6006dc62539c6192a7860e4872965, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3de74f8b-9772-11b7-bacf-48485791c923
  2 1b545dcc-2bfb-880a-9b59-e1d5dfe0cd48
  3 a51bd8cd-4b2b-019e-98de-e87280a3c6fb
  4 24f03fde-296f-569c-bb89-feac2c54a99c
  5 e8c6374b-e3e5-6188-a579-776f51035bfc
  6 cd653e16-63f0-083d-8349-e62b44217ef7
  7 64444e45-5a82-7353-83fc-7a042440fbf7
  8 7c1b6ce2-4783-287d-b740-3d4fddf3ac54
  9 209b0e97-f3d2-3a74-84fc-9535424a514f
 10 e534efa5-ada7-30da-aca3-1fffd7bf4c7d
 11 2ac50726-9080-18ae-a12f-5b94ece0876a
 12 9e487862-33cf-62f8-b796-39f9728a1e72
 13 efb87ff8-8118-5d03-a866-e3dc28b3bd89
 14 4dac98a2-593e-7d82-9d88-d06fdd50bf38
 15 a6b9d87f-af33-6138-8ae8-eb94a2b58ad1
 16 9fee3d6c-d073-7e25-b436-a44c87d066e3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1805607233165767. Exactly this sequence comes out of new Random(464).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 12 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs