A858DE45F56D9BC9 archive

201309131359 1mbt9u

explained decrypted filler

seed 797

Metadata

Post ID
1mbt9u
Title
201309131359 → 2013-09-13 13:59 on A858's clock
Posted (UTC)
2013-09-13 17:59:59
Timezone
UTC−4 · title 13:59 against posted 17:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309131359) = f710001dd4b0909b76488f91fc6cfd05 (name+title)
GUIDs
24
Filler GUID seed
new Random(797).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
25 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A0047E23D29AA099 D73FB7019762ED3D AFFA0E357EBC2CDA CDC036534B0082DE A8736E96DECE1166 0393BDEEC8B8CBD2 9B1D883839AEE0C2 564A042A2756215E D5C17C558286D1BE 74B6DFE8B46F71EB E13066478CD0D770 30B12C5E7C466964 33DD27AAB87B1278 125E5F581E2D30A5 9D1FF45DFD0CDAA5 019176C7F523333D F7B382FE0B769635 2D88B01C567BC683 904069F8B50864BA D1EA2CE4B75A70FB F961E9A2620BAFAB A562E83CDA1ED074 07A87C7EE34AEBB8 7A0EF37D6DCC09CE F703779EE983E358 571D8DB392E0FCD0 D8508C8AB7A49E1C C384471BB1D5F4AF E0F4866C4EC64EEE C6699B73F408B034 6BD7E8026A199DC3 53F7C616C6C75DBE 74412C77CB01E0C6 C3E898305DCCC6CA 38D0909FA1311C7D 14AC99909C644712 45EAAC057CABB59F 935FB352F831B07D A86989C57F959372 AE98834B4523EC0C AA228AF30050869D 5F39433AAA5BBCC6 AB5A69E3109A6F73 36608A05C162E2E1 FD6DDCBC431532D3 2F98270D2BCBEA7A A7C20E4AFB275D79 FA0204B1BB8E0903 1CA9F957B4A7CE54 211B49B91577F0F8 FC13B77D9982F69E 840E68784AEFF093 CD1FFFEDB682CA32 39D5AD6DE1C4C998 32AF2B17039CD6E0 809B8A6266B80851 B94F233A10B80F9C 31AFFC5A084237DF 682E2E561F57CBB1 A458DEEBE6F72688 B35017C7E0909683 F37DDC81675BAA38 DAA08E6AF9965612 C9B0540D62AE7482 F5158D98F33CB641 7B5EC515B53DEB8F 0FE821C2D13705EF DE8B46C68959DC14 0E44B35DDFA9181E 960A12033851AFE3 5DC3A6704AEE3ABA 9052059DD7B78F40 F348940F733CE5CC 5DA48BF1BC81B2F2 EAF52C500AEBA0C6 27DB599A87B1F4D9 493DF5B749CCB2AC 22E8FAFCF5104EED C2CBA386BEC9AF5D 964179B36EFAD3BA 6B97B0E9312ACC21 6D2E119345D97B31 330805D5B8DEEA37 EB0475C88F7ED0D8 0C90DC4E169121D3 BCE66F53485334A0 D0C6F205FE646246 20445C0BE58EC9D5 A7CE4153204B5556 CCBE6145F14A40ED 4A606D2E77772833 10379E25CBA65011 2B866686B4B029A9 8E1A78A4826A8F4C 3575AE92E9C9C874 CCC9C9A1818BD536 7BE9928881E790AD
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309131359 (name+title). Key = MD5(password) = f710001dd4b0909b76488f91fc6cfd05, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 579750bc-bbe0-0be5-8b43-59dd50282c74
  2 b9169928-3073-6648-bf83-c50905364a5e
  3 70fae7d4-2446-7378-b867-c0b335897c9e
  4 c39a4742-eb11-6837-87bb-353516e82729
  5 a8173aa1-63b5-0257-9c86-a2d3a27d8e54
  6 d9ee8056-5863-0ef9-a636-8df856280f24
  7 3c90ea6f-7906-0490-89ee-c23f9b9acdf0
  8 90a6672c-ac47-2d9f-8c39-b1dbe6b1808d
  9 e82f0d98-d981-54ee-9e44-9ca0677cebd0
 10 b9b20a01-6ba6-19e6-a32c-e733537e1ed8
 11 1213d99f-2ea6-465c-8106-f017405608e5
 12 5bbc8d6a-52f1-622d-a648-b2646eb50fe0
 13 4028a97c-0bfe-468c-90bd-42d60389a70c
 14 72e00bc1-afa9-1fb8-b088-e397db62ecf5
 15 5df472df-0ce2-734c-abc6-4ded6848e9ca
 16 34cb7707-a07c-67b7-8a35-b8dd1c1072c5
 17 2363395d-2b90-7d3e-9bb5-e80c13cada08
 18 5059c859-db42-163c-a6f5-851ea1ba7362
 19 0370fce4-4ff5-2647-9161-cef6d840cd52
 20 687b2d92-dc1f-870a-8df6-7f35e744b1c0
 21 9322079d-8075-64e8-a51a-77615a26a82e
 22 9dd1db5e-3698-3506-aa24-6108bcfe2409
 23 bf6e8f4c-c926-6281-8517-dee2639aa071
 24 82b6ec4b-5174-409a-aac8-861a41bdb728

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 067600025146417671286364. Exactly this sequence comes out of new Random(797).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 25 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs