A858DE45F56D9BC9 archive

201309021559 1lkm7t

explained decrypted filler

seed 154

Metadata

Post ID
1lkm7t
Title
201309021559 → 2013-09-02 15:59 on A858's clock
Posted (UTC)
2013-09-02 11:59:57
Timezone
UTC+4 · title 15:59 against posted 11:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309021559) = 09daea55d59df6e2f8a7a693d0475fb6 (name+title)
GUIDs
24
Filler GUID seed
new Random(154).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
21 · predicted N = 24 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

89DD2BB4B9975700 4E98FE3A0F051804 48E2630EBF3889D7 B25F58EE33365B53 6EC3D1E21B96C521 413B51B1F128D786 0361BABFA8553EBC 7A156AFFAF456572 73DF5FE6AD25D284 96571F7D2A6480BB FEA0C7BE133205D0 6F80EE3632EF40C9 1806645727D80035 D54BC8BB999CEF85 189ACE83BD7AA9A8 57F76C8E87459104 F9F03AEFF35A79AD 999FCBE45BFD6247 6B7203166F27B86D BF63CB3791D23AD6 24C3C6996D1C74EA 2B91662A2D8BCD81 B08FEABD1A8D94E0 BB072EAE842C1E6C 93643EDFD34BF8F8 6749D999B1B08219 D31D13B1CD98A05A 1626B56B943DB736 86BD2B214EC0F8D9 03AE8E98938F00D1 6E722AED936BF565 D682C4416EE1513B 84D03B92A1880A3D 3C911190258D2AEB 15F97E02D10486D2 43CCAF6385BF28D0 5C9FE747C041D1AA 8C539C33F7AB91FD EA65C14B8D6F7A21 D6BA16D58CF93D48 8D6D4C7BAB48D270 56BFF989B2EEE75F 0D13C25C11C8ACCA C1EDA17723F0214E 9FE9C871B774647F B2B1F763A64CAB35 86B3E6FF0AE7336D 03EB3A465719AA95 841A9A21A51F39E1 EBE0DAC098B9BF97 719B76B9708D37A1 EF314341761F5925 E27A8EBA95C239AB A3DF41BD026584B3 68F26FA6BBCC78A3 94DAD0F2022820AB 4968577C286DA7B6 53E0432E0DFD91A8 8565D8B8BFD6E01B 2E99C4A1D81DD396 52612E1DF0F7C78E CA954AE61EAA8E3F B7E01E4E0E0D36D0 6F4C27FE31E3C177 E80C61B1CB711AC7 DB4B35EFD4823C55 BC6F718A5247CF79 1EDFAEDD27205DCB DAED0CC0A4E0C4C8 B1B918072F029B9A BB1C719219B6F01E 825EDDCAC17D0CC1 A283AD19DA0078D4 059D89C52EEA06FC 225A410C1040CC69 2F9E6EA78EA7BB85 7F34811A5FBCFE4D 91AF1E159404C5EF F5DD850937FFD20F 0A178A6D5229A9EF 426D440FADA18585 9B8DF82C85708EB7 C90F7DD1DD827CF0 256AD67D467E2238 9EE17A78C67D3DFA DD40BBB45D5726FB 7C0F037529106FCC 4B4D9709D2A8EBF5 FDCDD93BB733D247 605B87450DD1A24A 53BED9D768FCE6E1 9A89CF0BAC6731C1 9E7DE60F76B60A98 9A4F31AAB35410AE 2E2EA43A5F95D088 EA8E70EB1731BB04 297F74A6B87C8373
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309021559 (name+title). Key = MD5(password) = 09daea55d59df6e2f8a7a693d0475fb6, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 659b0d50-7127-1415-a2c3-5b4ac255527e
  2 8d0ad4db-eb1b-0227-9e45-6622d86fcf96
  3 77c7bfea-0b7d-38a9-aa24-6e4d02ce404c
  4 6c5c37d0-aa60-3489-8d6b-938ab1ae99eb
  5 bac96ae5-71a6-6c08-843e-423479200644
  6 44c23b36-3d99-1c2f-b09d-05602f74a8c4
  7 f3b78155-9f9c-83ef-9d93-300b91b02b1d
  8 19e5880b-ad39-601d-88af-e504a85fee0a
  9 223331db-4c51-0f11-8115-c4662d89c9e0
 10 4e482368-a09d-0592-896c-f6d7b702fbfd
 11 749486d9-4539-6977-a5c5-303b0fd797ff
 12 c9c7a766-124b-6df9-b2a4-58fd750872f0
 13 f77305a5-fc8a-4bf7-acc5-5ddf49f9d283
 14 b74886db-d847-5c49-b714-798112e19d6d
 15 f5057609-b38e-7002-93bf-68d7cc9e8c4b
 16 764d5d2b-a76b-1caa-a684-90916ce5aaf6
 17 fd863292-edaa-5d73-bef7-fac1cd086546
 18 60f779a5-f745-4743-b5cf-716dc9b2b6da
 19 15598e50-a8af-7b6a-842f-20fe353d12a1
 20 a96a0f6b-d765-8f69-a928-b318fddf27c1
 21 e629d636-7723-2c8f-b87c-fbbc7f2902c9
 22 b955e920-b765-5c15-87dd-6ba4e416a32f
 23 06e59f68-a63f-094f-8a9c-ffadc81b064e
 24 a43d44b8-8566-7ac9-9329-3663bb413227

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 103361860066457154782507. Exactly this sequence comes out of new Random(154).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 21 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs