A858DE45F56D9BC9 archive

201309110059 1m4or0

explained decrypted filler

seed 156

Metadata

Post ID
1m4or0
Title
201309110059 → 2013-09-11 00:59 on A858's clock
Posted (UTC)
2013-09-10 20:59:47
Timezone
UTC+4 · title 00:59 against posted 20:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309110059) = e44bb7343735885ec93d7d960afb442a (name+title)
GUIDs
24
Filler GUID seed
new Random(156).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
88 · predicted N = 24 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E96FDDF7C695A950 C778CC230CA25A00 FB199A7E4BF9C745 DF29DF9DA850562C 02AE1871F09EA632 409B5158D2365433 3C7CE7D2C554392F 1494FBB96723A21B 26DECED15059A897 926EB574A48AF3C4 7141C8953D41A8F7 E87C8340DF3ADD9A 7D9FCAABC2E07FFB 7BECB1F6D21083D8 462250C93542EB97 E76D97BCD445EEE3 989B5EB2B34A26F5 4AC362AEFFA63A29 3D430FAF90165539 0F74DDA78B6BE3E8 8A86270A4DAC159E A63AE1F1DDAD8C48 A6180BB3B4AC3F5E EFB228EC4D33F24F CAF6E7FA89715B72 630A9ABA32D4F178 8CAC3EE7648DCA99 DDA6B37F60E3AE2E 8A8932620FC7D504 52A87100C797C323 5069EFB0D21CA39C 2306F599658F2441 A175CD33BEB362A5 8E6E97D2D30E104C FAA9509C93697B0A 3544AAD6A12362FC 2EA981F7260EB2E7 8D74346A3FB8B684 FCF0694CE8B63AED AB57AFB454393767 D06ED3AA5800FEA5 EC4F3E5B8F1A29A1 AD450D37C260C35E 7599B72AAB9D04DE 86EAC1D5F5926AE2 AE2CC0C6925273FC 26738590CB6EE864 E25CD5DE2DE71994 818B8D0615F26BF5 02263BC2867C1D0D 855E42F9F84FB779 EBCA91269050DDE9 30A581512981D6C7 46BBC07FDBFD5D07 18C9529B236063D6 DCDEFAAD8C74E9E0 472FB658DB3B07F6 EFD0F47B60104704 18370FF04563588E 7601CB59264F383D 0E9DA8B1804A0C2D 47875BF815A3D0D2 BA1A3D1D31814375 7C7A28FE7BC9C9D8 6D20905B516A90F6 43ACB5DDD6263310 62233D0807969E15 F7C2294A92E444F6 8C0100818D141D66 A4F734FF50AC0FB3 759BD3D20832F272 47412D48E79164EF 1F6EFBA6469624DF AB1C278A760C8D76 AB6FAA9F2E2B7B7D 0181D4B99B48BF0D FF5C1DCF41BB2991 E0714B34F68C4967 0C404788FD9B7A5F 1536B9BB6CAF9FA4 022066225B2B5E2B 988351F3A714F18B 6B013EBDB3AFC9AA 3D1EEC628EA1C386 123175E2E479A895 E2973F7351F96274 428DDFCC6F7F8F26 9AEA83D6AD790287 23D2826230757ABF F0DFE9709507D43E 018092D712D1BB7E 7F3F1266F3F0F5AD 1983F9D37982BB9E 895AA5841621B531 2BDB91184761D05D ABB950A300E990B6 FFEE475679409041
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309110059 (name+title). Key = MD5(password) = e44bb7343735885ec93d7d960afb442a, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 69568309-1248-2c80-aa13-65a3f6c0dc49
  2 be09d2b8-4412-520d-8f95-c0a75786ad89
  3 9edd3141-0506-7a18-b231-fcdf06efb492
  4 e9231995-cb29-7d1b-a059-751897109aa4
  5 fdd9e6ec-03de-57be-859e-3f1e33dd2720
  6 93c44012-5329-7dfe-ae23-af2182047854
  7 a41ab6bb-2980-7f03-8c4d-25cd6c8126b7
  8 78f52050-b793-6cd4-bdde-311409d4320a
  9 632a6450-7d65-2604-983c-ba72c284b240
 10 f080dd63-659e-7062-a9e8-18d35f49db31
 11 74806684-e94f-1414-ac56-5c32afb1cdaf
 12 ae122169-e054-26c0-aa32-77583fd35e6e
 13 6bab2433-d8e7-7fd6-9a1e-27630841f134
 14 5c735827-ba2e-55b6-a994-adc54a3f0581
 15 d649cb24-3460-1e8d-bb92-1b04d29c9351
 16 a406fdee-7152-493c-acec-41c6acef89f4
 17 6b5e8fb4-d59a-3850-8758-3017d159593f
 18 9bb2280d-0e32-6210-ac43-f916197aaa5c
 19 c8f3ef8d-5f12-83e9-9d46-d4ff9e0d2827
 20 fd0ad51e-640c-650d-8daa-94505fc03c3f
 21 d356fc27-d021-40d6-b244-3893d3142567
 22 c65b9721-fc58-190d-a318-c09dde15c1ed
 23 5e8bc164-0b6d-302a-8922-cc160bb29b34
 24 28904c79-482c-4398-98e9-37587e08ab9f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 257757762712751436864134. Exactly this sequence comes out of new Random(156).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 88 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs