A858DE45F56D9BC9 archive

201309040359 1logyn

explained decrypted filler

seed 194

Metadata

Post ID
1logyn
Title
201309040359 → 2013-09-04 03:59 on A858's clock
Posted (UTC)
2013-09-03 23:59:55
Timezone
UTC+4 · title 03:59 against posted 23:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309040359) = 93d5af18f6b590333dcdd04724ea1da7 (name+title)
GUIDs
24
Filler GUID seed
new Random(194).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
33 · predicted N = 24 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 2
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4698FE5BA67E29DD C96EF6CCC98DF41E 694548F53F074F8E DA2F7D920010094E 8E365AC86B08BF99 CB315BD7B5EF2F93 1179265C4927AC07 AAEE2A59567B4030 FA0E70E5EE9E3825 E9C16E29ADB56232 54D89FBAE1220D1D E812F5B8C9C05C01 D9D329E94528C04F 7047D7BE426EEE78 FAB798418F1FFAF1 91825B8D5FFD96FE 46737342F4A82948 374CCECCD50F998C 87D400D737B02CAA B23AE91C414D9ED1 B161DF65F2786AF1 E6B792F1201C1BD4 69FAAB707F7654D7 306626D53B9410C9 661BF8AC0525BDF5 0F520FCD669E9314 E6DFA34732F1AFD3 768E66E8D764B10C E092F39F31F7155A 11AD1BF42E7B70D1 61D5140CA01C33F6 95579CE7677BD258 C69EB678CF8819A9 3A49C3C8A0E7E9FE BD9F5C08A004B98D 0C30D1CDE6C1B1BF 6E48E4ED7A9E30C0 A3A4AAE719EA765F 3170F39A2A028863 ACB0DE48DC3C023C 95E43B321A7A6460 1C9845059A24F9DC E4F47C0F6309701C C8758E297F25C783 DB4632B8411F71B0 6EFF01DA858C15B3 8E86A510BF227410 1F38017925EF785F B30BD47E1E04EE74 BE3FBF5EC9C54495 79DB93F014E63400 2A4FDC87C8D9DA3E 104A713BC14AEF63 247C7ECD9BA00013 43CDD78B17C7B71F 3D966CB384A340B0 5E70451BA32A52BD FDEBBF9A3B82284A B6B9A4FCE4CE4DA2 A5D41444BA3B1C64 A91E1F3D993EE239 614DE1FF2A9E1FA7 62EC6005A4073922 ECF197F1EB554CA7 E32BDC289476052E 2B2D9F2E98526D18 1D9D2DB2FAFD15AF 1219647D405DC2B4 544A894330A8F6CC B841A98AC3C2284E B16C79457E582165 83811BE8F38CE41F 9E62CC4B1E966251 75B06E0858F1AB4B 287244CAFCC67267 D2457438F3C569F6 FB6430FBC90F7D9F 101D8FD2BBC18193 37397B4675850E06 37EB2945A333B846 B1AD9E3C07A5069C 67D8F550AA9D7793 A23F2796E6EF3E80 E955F55C0407C58C 9EDE199C666F639F 94B48DB5D7ED2D7A 6141047412C971A3 BBD175609FBD6295 81AECC92DA5C5559 B00C09813C386BC0 742361E1EE9C3309 812A624DF7BC44E8 380233E893E9EB03 1EF0D42DCA816542 12043ABAD718A9A1 DA6B5F74AF984676 EBFE69ED4D6CB64F
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309040359 (name+title). Key = MD5(password) = 93d5af18f6b590333dcdd04724ea1da7, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dc6e69ca-3316-0fdb-84fa-dc4b65f6f05a
  2 79445293-c87c-6574-998b-2d73a578821c
  3 a368d76e-47b0-3e82-a13f-ce3f20c233c0
  4 0a2330c8-5675-89d3-b256-482acedec76f
  5 10d7ed1d-1533-7b6f-a8b2-43b389881baf
  6 a8862ccf-597f-0af8-855a-39951afaa1f0
  7 4d6b1974-abb6-7d26-bcb0-02529f973cd5
  8 35521829-ba05-62bb-99a7-73c01a84bf17
  9 3580f5bb-494a-834f-8f2f-0970a0dad330
 10 6f3f782b-109d-718d-a890-2522a4195cda
 11 1f8110a2-5672-1568-9f5f-0e3bff63a170
 12 658e6c49-8cda-84c5-bfbd-1007fbb8e470
 13 06b88d0b-d2b3-8e76-96f1-76b0ca926964
 14 5ade017d-6e31-31ad-b131-fd2d09d134d5
 15 01f0f4ad-3c1e-69cb-ab95-1a1a260d1fc1
 16 0beebd1a-aeac-187e-9e44-03f81e8744c5
 17 94e56523-3e87-3712-b04a-fc1f52eb8898
 18 9c02a960-20f5-23f1-8602-752cecaada35
 19 bc33707a-25d0-886c-9237-b26e67016fae
 20 e0654c6a-95b1-321f-85de-c6b9f666ac72
 21 535bd7b3-a137-502e-903d-fef4f1b5d0ad
 22 50ae029e-ae97-347c-bfdb-7ad940420fb1
 23 b2784be5-149f-7430-9b4c-a976b9041ae8
 24 9188257e-de89-7459-855b-c31441cd0622

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 063870768718836132835377. Exactly this sequence comes out of new Random(194).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 33 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs