A858DE45F56D9BC9 archive

201309101559 1m3lsi

explained decrypted filler

seed 623

Metadata

Post ID
1m3lsi
Title
201309101559 → 2013-09-10 15:59 on A858's clock
Posted (UTC)
2013-09-10 11:59:48
Timezone
UTC+4 · title 15:59 against posted 11:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309101559) = 024135dc1499afdc980a8be997c76f95 (name+title)
GUIDs
16
Filler GUID seed
new Random(623).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
85 · predicted N = 16 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5A551B399E69F3BD 33057CC84CC4D9B3 84C1F37ACF7816AF 64C00917D3461C8F 50A89437BC134BFD 78DB5FF05F8262B1 32969E993AD7FDC6 C5B6F1186F377B64 C8EE0A12A6CED9AB 5A6BEB0A5D17F95A 3126892B0D94A83C D111254D2036F1B6 1B7B40B40B5FCDA7 3125F7471E229F64 0908A7AD611510C8 A3726D77C5C43FA6 55D8F4F2C3695B6A B0330B430B4894EF E341CDA76E022FC4 D16107B675A50154 45C0A4BE8028D44B 10FECB3A55AF6BA5 77F9F878D36514FC 613A3CADACF4BD30 BF2463B510B82F1C 60A830E18D5111F4 3AEA5EA9A5E50853 4CB945C6682CBE6C 899A2FB4DA0D35C2 202CBB2E744AD5FF 16B777C308F49C03 422A0244D304C199 1D50C50816C3E621 ADD75DCE9FFC24F9 650B141BEE8286E9 ABACADA49F9B9465 E8D66C1114263D7B B0CFCB92AC3739D5 77BA66703CE4F899 62372E2223CA8FCA C59856A405BE20E5 7A7F46755A54EDA8 CD69B62A30D9FD73 BE37CFF67BEEC04D BD0086DFCC10F3CC A95A5AD3F65EB34B A09D7A54B68DE810 FDC3503F7CE372D9 AAA8D9D0FD320F5D 450B8B0A860B3CE2 508510CA9C0320A3 8DE3AEE682749909 98483A48E4C7FAAC 4698F009D4369C65 C6EFDAD48D4B82FC 4B84F49A8A69AB4A 441AE9D1AF8CABDD DEE9A51204D3146B 0C054A9202C2ADF9 383614CAF0851BF4 614E5AEC5B24062B 97B01000E8BB6DFF 3AE4659DC373F21B 74080331E1534150 EB7CA5D38D9F53C1
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309101559 (name+title). Key = MD5(password) = 024135dc1499afdc980a8be997c76f95, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ffcb6057-4e3d-1012-b523-dc63ee9fcbe6
  2 1617f484-4298-5e0e-a36a-9b8a3962c72e
  3 cdfad598-ab2f-2a70-84b3-70d8ef644cd9
  4 a1388ba5-864d-4f8b-bf4c-c422e0d0e45b
  5 9db9a5f0-a1f7-4281-bc2b-e777040577a8
  6 d0f263d9-2a4b-866d-8363-d7615ff4230a
  7 079c8e91-eab4-010f-a36f-01e21a531a79
  8 a5c9e8fc-fb90-804f-8e2a-d693080b7328
  9 c7547beb-8106-0dc1-9f2a-9f84beae8597
 10 0201a66c-97df-088d-8584-4fcab358381c
 11 2c8f288b-522f-28f4-8e80-27826718f918
 12 112fc75e-99b4-786d-bc3c-8dca0115e39a
 13 715dee06-b9ba-86e5-a847-c6fd78eabe5a
 14 4120862c-94ce-5727-9b0b-4437e92f74da
 15 86c4e49d-f1ec-0e99-b92e-70286c148665
 16 1dd21ee9-047e-0a81-9223-b81bc4c1cd9b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1524480800278500. Exactly this sequence comes out of new Random(623).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 85 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs