A858DE45F56D9BC9 archive

201309090659 1m0ea2

explained decrypted filler

seed 324

Metadata

Post ID
1m0ea2
Title
201309090659 → 2013-09-09 06:59 on A858's clock
Posted (UTC)
2013-09-09 02:59:49
Timezone
UTC+4 · title 06:59 against posted 02:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309090659) = f2cb22e8220894f0c31e53abed8a159e (name+title)
GUIDs
24
Filler GUID seed
new Random(324).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
74 · predicted N = 24 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D603BDC099B6EC03 135D47705F0E5538 9DD039BF0E38331D 2D3F10955D0D17A7 E459BE8D1CAA8407 AADB41209991FFBE 1ECE2076266CBD91 52B3036E63AEFC06 404622E2B8750F9C 437FFEFCE6F6F538 14271C158095BACF 93FA43530DAE0CEE 7A97437D525F664A 02156CC9E84DF9FE 8F3E676DDA795619 265647BE64E11CB5 A9F060EE0755D652 A79D16FA4C3959A0 39A6950D6FE57815 00D6D164C2A88D9D 8C958EA201DB50DB A14AB82F91A26E3E EA1F3B3351A6DBCA 2F14FF07DDD5EA46 45E32489151D81D5 4541D36C348DED41 DAF7B3C796436A5E D3E3DFEFCB228620 2DC244B2A3FB3642 A5BEE17648D9DDA0 03292DC619B9C93E 8650EADF75FCAF96 31E96F8A5E2CAEAD EA110D336DE39EE2 5A49165F35866669 7236156BCD1C6B79 1BA6B415A9A4A36C 22A8D8AF811A6386 7442083375D9276A BBA16D6897F274CE 1B9042B37C5AEBCF 54659CE911B01BB9 B0C6B96C94EB9854 2B5A45629545361D AF9290B6F1F4C32E EFED255B5340F453 3786F131AA6C5343 845A15A5CE690E97 B91216C047DACF75 169311E7D8B4F4DB 65C47E6B6882503A BA11D399F8C83F9B 444E7D501E701431 5B15C61FDB6D2B2A 25BC6B7E65F5AE93 99EA9A34D27603FC C18DC636203B22FB E369411975631655 BAA8CF9CA16B0AA3 BF33D30CB022EABE 5C3AF178FB8471B5 D95D91F52D9C6F82 47E9616D5D373C11 E6B2C0B01F2AB00F FE51AF5153513D4E A0FD6B3F331B7818 087D8A3A30DBD94F D979648FDB4869AF 62E23C1F94AFBD84 086750DFB3D8914D 67ABABDD481646D5 BF428201573EAF82 F2F8BAAE97B0AB65 3E19CCB871B25DD9 C0CCDACB662C7285 FE83BB03997AF6A9 9634CABC4DF53F83 94FD9BCEE3FF64E0 54A9B9ECF6BC7BC3 E87752CAE1A6E855 3F2201D66F70259D C55F32B939E75D3F C167755DC862A749 D9E1E9CAA9C792C2 3C87553016CAFD12 DE7C14734E36DE59 93F43885E415AD13 2BB00F29C2885AAB FD7A39772A7480FB 263FDDD8558B5B02 E46C15A2868534C3 60CE2BF6E168A81E A243976DDA41E408 94CC94E795BCF44A 1B5FB0124DB0D6B0 DE49244A052B266E 84AB85E83962E3A3
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309090659 (name+title). Key = MD5(password) = f2cb22e8220894f0c31e53abed8a159e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3242c5f9-4482-852a-9bd8-65907be997f2
  2 74af2c02-9bcb-7043-a03c-fe1ac29ccbdd
  3 a6f50ae0-ebdd-29be-90bd-b6393f984a2e
  4 4f16f16e-655a-69cc-8b18-928c8f233513
  5 544ee214-6a95-4404-b050-cec816c4d2a0
  6 f6fd0863-79a0-6490-81f8-495fb472436e
  7 bec27078-0dc0-0877-829e-6f9a78923479
  8 aa0b6597-5a18-8c75-badf-19155472b2f6
  9 3557abd7-b109-01c6-951f-ce339e6cc8b8
 10 17b661d3-665e-6d19-aa9c-72feceb6e546
 11 be14bec3-0cfc-84b1-9fb8-88770f26fce9
 12 d3020f74-da93-3bb4-b980-b2417421591b
 13 4dbaea98-43a8-39c9-96af-9fd2d83e05a0
 14 cc29ef3e-3239-0a25-9b2c-fe1cf39b95f6
 15 580f4bd0-e1a0-6755-ae9b-2b5dbaa4acb8
 16 8c5e9d6e-2d5d-37c1-baf1-6e17fe7cdfd3
 17 7c3f2d9b-88c5-021e-9bf4-3ec765da6909
 18 689bdf84-c490-7607-bbe6-5dd78cff32bd
 19 f274e0cc-7ced-4b7d-837f-e2578aec9d17
 20 26ea2855-5f2f-6bb0-86fd-f5af9ca4de78
 21 e93fcc79-1b47-7a98-9453-fe86dd66fc83
 22 6e196895-130d-3074-98d5-58529317748a
 23 bc7f0ee1-7423-6b60-9c4b-7ffdc653f250
 24 4889c19b-dd02-118a-97db-7856d7bc4e57

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 872646080683306307467361. Exactly this sequence comes out of new Random(324).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 74 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs