A858DE45F56D9BC9 archive

201309122259 1majma

explained decrypted filler

seed 595

Metadata

Post ID
1majma
Title
201309122259 → 2013-09-12 22:59 on A858's clock
Posted (UTC)
2013-09-13 03:00:00
Timezone
UTC−4 · title 22:59 against posted 03:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309122259) = d0a2f8feb2fbd8ff94435d33428eccb2 (name+title)
GUIDs
16
Filler GUID seed
new Random(595).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
10 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3752B92E3A399405 99028313E5598D80 9180BA2FAA2EDF62 4E4D3F4860D914BB 4CDC43E5FD92083C ACBDBD99475285AF 583E6BE7990D31C3 73FF0A6B93BC942A 51714200EEB45100 4561E59226B8FDE1 DF04CE5E506F6BD0 C41EDE5A2254EB1C 67665827C4116047 177A1C978B84E832 D1A13F6EEF4F36EF 02D6115F54DA8A93 B51C720C3C0D7854 EF98668E2421FC67 3EF887E5A0EA5014 CAD011C760E5883B 995FF3BED2A41951 527E73F7CD4B17C1 B44BDA7163D3FD70 66627F3E280105F5 BB322957B85F7447 9196535D470B8932 696CD68AF590AC25 75E2A906D866035A BB5A5BCBE1934A7D 7CFA8F98F58B7697 F9734C04D07E77BF 9802A1B51736CEB8 714609514766F28E 22B71FFF5B454A86 FE8CE00F305CCAC8 23016055C6F8A071 3B4E9943CC3575D2 311A51B409166632 B8CA24AD9B8A678E 51C3146369765AE1 89DD33CCEC677973 7C11BFA8D7503330 4F400ECD52DC8221 DB9E758A9D896C36 6889537B7B062910 95760C18D42D8800 F0AD6F682A88EF27 4CD511099536CECF 96FE57B2D03131E8 E3B7116444202847 BC53A32E5D2E35C1 9A921700303F4E31 2ACB9E0EC0479FD0 11B26B75F2E99FBE 440BDB7547E6F2F5 FFB6D9CAB029919A F1D15F84DF943AE6 31B7B8090D0A3690 20770E987FA8F895 67312A2538FA91C7 30DB1A1A357DB8EE 73FF017EF2D3EFBC 90668ADFF3DE6A3A FF7605DC6F1D1118 3CB4A59B050108EB
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309122259 (name+title). Key = MD5(password) = d0a2f8feb2fbd8ff94435d33428eccb2, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f4be9da8-a9ef-5152-bc05-179375550fd5
  2 fb3c13f0-679d-35cf-88f6-18f07fbfe05f
  3 d8d8cb1a-1d98-5bf4-b2e0-977d996bdf90
  4 4d8a9650-5863-5bba-ad45-00651094dcf7
  5 b3ad2cdd-9ad7-71a1-96b7-89147de50deb
  6 03d9801e-1130-4e93-8272-86cde3209933
  7 ea73d386-fb85-4faf-bee1-632d96e6116e
  8 27457243-50d2-89ad-9966-03864e4ba86f
  9 97020100-f46a-5e6f-9da1-0fcdccb8eddf
 10 d27f5c0b-7a44-6a9d-8cf7-c4adc30c39d0
 11 12af6261-9610-5ca6-8bc9-739b1877c769
 12 3da244a6-14c7-8655-826a-320b69c64d9a
 13 97287e65-f35a-51f2-a9ec-93b201faee76
 14 81cdb191-dc2d-0a54-b143-e67c2da14d1f
 15 e93bb2ce-b805-49dd-bdf0-eb525bb92bde
 16 355f02d0-7e4d-5714-bcba-312fe1cb4d23

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5355744856585045. Exactly this sequence comes out of new Random(595).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 10 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs