A858DE45F56D9BC9 archive

201309050059 1lqmxj

explained decrypted filler

seed 145

Metadata

Post ID
1lqmxj
Title
201309050059 → 2013-09-05 00:59 on A858's clock
Posted (UTC)
2013-09-04 20:59:54
Timezone
UTC+4 · title 00:59 against posted 20:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309050059) = 536c1131f41e32558de6ae8b5073ac2d (name+title)
GUIDs
24
Filler GUID seed
new Random(145).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
40 · predicted N = 24 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

99CD0C16F2A72760 9C964FFDE56E7F16 43A514842475A4D2 3206751F38BBD717 E7B82712752C6D63 4F4860A162CE10B6 7ED0BCB60601403D CF3BC9848837099E 0AE76217AE91C343 CD54056DE5806FD7 EA87EDA1D1E54DB8 4FBA0B4BC9474A25 E36DDA39A45F247C 18A8FD8EBE0F1396 73C45DA5471AE9E9 E9E40DEAF593245F 1DFF7458D35DA625 C30C60E183F08DB2 728974EB024E78D8 22E4724A1D859BF8 760F698C91208749 21BE946F707AC423 10DE8166437F2D92 7BF4ACB39C7B65D6 F82C26F38E4D7CBC 1A3D26D0D861B773 C0DC745E5419F04A B337982D8958EE42 0B12E46A96B3C75D 5F6CCE7E177BF2E2 949BCBBE67D85AD0 519A78887CAB65EC DF0A3670D54554CE C96B5D351E122C07 B980833A1FF38229 81C791701576C3B3 DCF74D56741A3A3A DED9937FF5139D22 AE0B970EC4AB3894 00513568013C043D B14B07BCC439EB72 0A09F653323AD681 CA13A106DD3D9160 5E1652427D976E39 59D7D92233DFE1B5 D5CF79D99DE60489 924CE6FF7121AAC5 9EBB1D960FB44FCC 9945BAFFA862762D 3BD414458D604C90 4751F6AD4AE2BBF2 555F9D31815913E3 F17914002DE0E6C7 E4019E075470C7E5 A82927FD809124F9 A22C0F6DBA28409C CC67CBD39F342A35 8E1D39C87836BCB1 0DE2AD61130D0560 8182E3FA2D804BBB 5837C4C3E70664DB 768C55D58D7C1A64 2B52B87C534B0228 D2907C47062C9D31 ADB38E9666549ECE 20D19AC22342FF06 E305749E50333958 F3E1935E6FAD58F2 A7000A7F0BB534DD 206DD8CE318B5A4A 22CF2BCEF7047203 30EC7068FFEEC082 391A870615888106 FB8A605E4EF29619 3E66BE8D7DD198AA 48A54174FFB0ED71 EC72F4F357D1A153 FAE375DE4B67AF22 5B54D0C4E8B94338 BB73FA7735F787DC 35868CC6D006C7F9 1710704614D20506 26780B1A186B68B6 2B1A301DF5E497F8 8EDC7BC347A7299B 78CBEFA196A14BED 6E2EC8221FB0DC73 CB9D7336389CAC11 53777EE7C216C332 32F3AA3FA33D45EF DF81F8E5FE1FAD1F CA2F4CA86ADB99C0 DAB0D6482EE98B7B 1FED419F3D973ED3 A908111E1540A047 522BBFC627302384 41ED9F319B24F7DD
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309050059 (name+title). Key = MD5(password) = 536c1131f41e32558de6ae8b5073ac2d, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 aba003dd-5a0d-4682-86f9-252861584d10
  2 63a6f9f7-0e75-3183-a1fe-ef92ce9e1b00
  3 a876990e-7db2-1708-ba7f-025f00e0ddac
  4 496020e9-85ff-49a2-bce0-3dc3755ef245
  5 7580ffd2-bbb6-6186-9f35-77e918607f42
  6 1d202ac2-77a1-2af1-b416-c756b79466e4
  7 4f86e07e-1f6b-77cd-aff0-76a15749daf0
  8 5096c00d-5569-105d-892e-a129dc72ab91
  9 e7ddddbe-9acd-8097-95b8-f4a7798d461c
 10 f4eb073f-2c56-6f80-8177-18c69c17de28
 11 e4fa90ff-b82d-1e6a-bde5-200f81004a68
 12 245b6da8-a841-6cf6-af77-c3967d3737cb
 13 070f51e6-c1e9-2479-bf30-1fb7452b4a7f
 14 30e0d728-1987-86e9-80af-948f538c85ba
 15 5b7fe198-0134-4156-b8ea-f9d5b6a57a31
 16 52477de6-f82a-5cd6-bd92-680141d6e9ed
 17 95205259-b0fc-7ff2-ae36-01bf9db85d94
 18 5ffbc042-ff7d-83de-8cce-1cf39588cee1
 19 1201f719-457c-5d2d-90be-b9e09b66988b
 20 9e2e2795-f7fb-45f6-841b-f033e6decb46
 21 71cbdf1c-0b83-0eb1-900c-164efbbbccd6
 22 6280091b-9724-3ff6-91cf-d0c8d17f6193
 23 eb42c216-d5f1-431c-9522-2061f14734e7
 24 8e5c5c5c-58ce-62c4-ab98-803ee78352f4

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 431462718616284578540346. Exactly this sequence comes out of new Random(145).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 40 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs