A858DE45F56D9BC9 archive

201309071259 1lwn9g

explained decrypted filler

seed 179

Metadata

Post ID
1lwn9g
Title
201309071259 → 2013-09-07 12:59 on A858's clock
Posted (UTC)
2013-09-07 08:59:51
Timezone
UTC+4 · title 12:59 against posted 08:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309071259) = 98ebeb08bf32581e4879c3337a034007 (name+title)
GUIDs
24
Filler GUID seed
new Random(179).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
60 · predicted N = 24 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A17A7E2CAE3A1FF2 972432A69F8DD670 867A8ABDFAE80521 7B3E1BC2B1854685 C5464D05272CE616 E029811D71845ED5 446EDB08240FB0F9 DE65DF3DE018E001 4173D1A21D929729 5D23BC5089BB9AE3 75DC91B83BF05D57 6E8D70EC0DA1048E 7F3155686D43D1DC E80566238D4C8DB2 BBD703CF8F04FFC4 606C97B510032088 47AD67BFB34DC10E DDE6F4E5B597AF53 BEC7A4EE17C29389 E5D5125FF93FB091 E217FFCCAF3C8BAD DB749942038D510C 87A3E33891C45A53 CDAD0E20B8455023 351DC3EDB19770BE 41164A881333E4A5 D9D0860313BA51AC 14FA53AB1D3C7A2E 996D75F98E70B099 07A335F2930C5DF2 E9F8A901B152A0C1 59A60E5E5C4A76BB DCEFA7C7AB4BEAE7 9C252AE32E425CA9 ECB03DDDBB8CDF40 C451F230AD774072 907AFD65988D5FEA 80ECD8D33300FE57 95AC223FD4054F56 C03E54C5F2F4BA44 95F990B40952A6DD 826D37562828399B 344C96E1D8027475 4BA74EA5156C093E FA6E5E9068116198 65D87216DF7660ED 33149955D4608F21 03CA4706395E5239 A06F51169389990B 4CD49F0201A779F2 53D8F17F4BF6AFCE 1B87606301FA3DEB 489578CAAA676ED2 F2C362FEBDA02503 2C0CA127E7E69C84 8B1DBC276E3BC2E4 83215326E2CD3277 859D23C0D894F6B1 25C44E5950929B98 E557125029CC7965 E33C47FDFCC3A535 E9F228F89C46DDE4 3E24569BE921755E E067C31B29808527 8ECA14F3675E8705 E5A564860F51737D 9513E6A77A7A8AB1 3E61C193657A28F3 ABFBA3AA9F8E26B5 55067E0A09409A60 E5B381CA9C0EF728 A6F49D95CB36A7BE ED0C70DEDD68AC59 908C7B896089A80B BC70138CE7A2E45E A2176B3BC586EF71 15A9A0701C156B15 B9C81AEE885B4987 9D942AD066ABD400 6247C92A75239CB5 2B03A0BB71FED565 6EFC52814AE7156A BE6495B29D4E5E8D 8821A30F43CE54CD 4DA353A0847BD304 B763668B51D6F78D 263774D7BACD0112 1A8DFB12A759064C A882CC3FB43122AC E0D9E52FB98D2B0C A2F3E8C857092DF7 DCB10FCD300C21D4 E77AF0AAF4E6C054 CC158D57093BD3A5 A2C6CE493C4BAE2B B255A1665437036A 1F6D25001A1F9D24
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309071259 (name+title). Key = MD5(password) = 98ebeb08bf32581e4879c3337a034007, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ef0c9204-03b1-2c56-af85-db2360c0a8e1
  2 58cb7064-059a-3cf0-a777-5c4f2cfa0003
  3 f4f13697-2249-7af3-9d53-d91455c5fb08
  4 0066cbe3-bb19-6a7d-b0e0-d6260644d3b8
  5 79b204fd-f648-0d91-a788-81225af19d50
  6 9512f83a-68d2-8c64-992a-41679b856379
  7 97b3fa28-70a4-0c27-aa46-0586d5dbdb4d
  8 3ac820ce-2dc1-2b7a-9a24-94ff273a12fc
  9 d07e3cae-edd7-19e8-9d8d-caf46ad85324
 10 beb42522-9c26-2060-97f9-d02c5acc6acd
 11 4ef72ffb-d520-187d-b56f-1e9a6fa8ce39
 12 3598a211-a469-1298-8842-7ac0d45bc741
 13 37a25b4c-4abd-67db-863b-b0f55acac329
 14 b1115b00-ad8c-5a31-a6c9-86d32a9da174
 15 089f632b-44c7-21ba-a264-797a37f24d94
 16 c2fdd64c-e273-73d2-ae9f-33fd1738b580
 17 2f6cbdc1-84bc-0251-a985-098963705ba2
 18 53ef2046-efac-8cc4-9e8b-3cf1fdb02cc6
 19 d59818ab-0ddd-4b7e-93e4-d09fef53e049
 20 6ba34b36-7166-5f91-917d-7fc8eff0649f
 21 85f256f1-9731-52a9-88e8-b934d74f7243
 22 d370eb1d-f7ec-673c-a902-e580348b7e2f
 23 b863f49f-a43a-2057-90fd-16bae51b2765
 24 90da36e4-12fd-5fe8-b5c2-f7d06d12614f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 237608021211652708455625. Exactly this sequence comes out of new Random(179).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 60 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs