A858DE45F56D9BC9 archive

201309122059 1maazl

explained decrypted filler

seed 731

Metadata

Post ID
1maazl
Title
201309122059 → 2013-09-12 20:59 on A858's clock
Posted (UTC)
2013-09-13 01:00:00
Timezone
UTC−4 · title 20:59 against posted 01:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309122059) = 578e89cfd7976c81da52d60fb70e5010 (name+title)
GUIDs
16
Filler GUID seed
new Random(731).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
8 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E6EC3024EBC6E621 8EA34394711F8F3F AEC60FE0DF6F2E88 ABDB5EDC274336F3 056E7CAEACA355EB B9C44AA532B1C6D2 07AB0D1FA427653C 598F4EAAD1D168B2 9576C84F2D23D164 6F10C4A2186D6E3A 4186A9708B878653 5F29FD9D3393F537 80B1EE9B3F115C3D C8E6F75F70670E20 4AE264178D0F690D 821756351824787D FB87AAE64B210395 08EA1FCC7E0E8319 DAB235E826A6318F 98A9817104A1DD6E 541BC05BAC28AD44 C1DBF565D5CDC67F 7C299472853E4924 956735288C0C470F 1A90E994C4C518C8 93D703E71D52B7DB AC8573465B61B451 8A755C43F64E6284 9E4637443D08081B FD3568F26C3AC65F 58EBC9FE902B72D8 5E8AAC0AB9EA8C80 458BA77F89084043 AC6FEC2C25744E23 9034257483F639FF B9435D7483FF587F 390E1B6DF53ABD4B 58A0F9A20D1B3AD4 047971584111B651 4C0116DCADA255C5 19BCE2D5A0F82BAA BA46A3315ECA6FE3 C1E2ED17E792B6C5 E9EC2F29BC963211 2BAC48AF2F333413 4FEEA355467EEED6 205BBB93461A8165 C401D1AA95984162 AE0777CA5BC6D40F 3A3CF4363F0ED679 E7A90B5429EECAF3 43D6497F0EC64233 172B12427557B551 1AEE9595B55AA415 07E06B44529C6809 A65C41F20FFF6D6F B92AE93D43AF4F71 40B241702479FE5E 01C45E842B29DD6A 6E1E33BC863D792D DA8D6024575D8AA8 C68F1B4135BC4169 09D6B171C173CBCA CE9BA3551F37E787 1585765B6678141B
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309122059 (name+title). Key = MD5(password) = 578e89cfd7976c81da52d60fb70e5010, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5e70f0a0-3023-5c92-a8c1-aff154c38282
  2 06f794c5-d671-297d-bc27-4046d2b213e0
  3 c1b85fa2-4670-6657-bae7-f16f619499c7
  4 7affbccc-911e-5e5b-a8b8-9ffb5a96bd67
  5 b481198e-4cfc-2547-addd-6f6b5d42ce05
  6 529e8188-507b-3e5e-a4e4-2edd07057de7
  7 26cbbe4b-a8cf-318c-a0eb-432c582e2345
  8 6cb75af9-e28b-1987-9e4f-f118e8f166d2
  9 d207a561-f2d9-3f3e-9813-8ae8ad343c7c
 10 f28542a4-4f07-7e77-a948-5defa7d36ad1
 11 89fef005-7669-7b0e-8182-29d6e6315484
 12 f7c4a875-cf44-1fdb-b3bb-9225b266b523
 13 3d891edb-ee08-151f-8709-0b7c88cbda75
 14 ffbbd540-fdce-672b-847f-94c692086578
 15 b39c4422-7f70-59b7-b17d-495c1be3c738
 16 45e5f899-6589-42a1-9471-f6d65d059f35

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5265233137711654. Exactly this sequence comes out of new Random(731).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 8 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs