A858DE45F56D9BC9 archive

201309131659 1mc7pu

explained decrypted filler

seed 612

Metadata

Post ID
1mc7pu
Title
201309131659 → 2013-09-13 16:59 on A858's clock
Posted (UTC)
2013-09-13 20:59:58
Timezone
UTC−4 · title 16:59 against posted 20:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309131659) = e0b0c8f1ece79aa20c62d8e6a4347c9b (name+title)
GUIDs
24
Filler GUID seed
new Random(612).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
28 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
10 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D35942B30880F152 003C280DFF6CEA92 CFA84DFABF3365AC 1FE0CD0C7AE926FB 8D49B9865296D798 23E04CDA4EA8AD57 AE2D32E35CEF0576 029DBE93C83ECC97 FA9F6BA91FDFA012 AE75CBF7AA12E444 21E7F5C9A13B4E62 F94003EB7E9F5293 CD6AE3EEEF111851 57AB5864850C78F9 15CA65534C0C24B2 C4CAF9F415438701 54D824F1A029A0BA 89CCFD9B31CE6CB5 E891A21D80510A45 E01E5B50E115F015 33DB2D28C47174AE C5C1762C86DE71FF 058FFFE0E9F37A03 D4270B2BC7A43A38 4302C9B9CADC7376 296000EB13D79B95 19F8C2BBCFAF8790 12CEF5043DC2F357 A1BBB83EC944ED64 02B771C223A93999 A20A1E6AE699F503 F3BE2DC1EF14FA45 C50BC67FB1CCB093 BF3C7092C344BA58 26562572439E063E 3A35CC52050416EB 83CA7519AA61E781 0A7B6D82EAC6CFCA F3558B5454AFA096 C4C604D2FB26EF98 E6273D832F100539 845717404016C4CF E40B4B42E0AF7A76 45F6EAD55EB515F3 60B038B7483A2959 DABA24B5CDC2C279 4285DB05CF22891A D1EB230FA775C529 CA05E5D91F669717 F08DAC0B63D0FC4E 59FE441F01DF5131 A80E783B3934C875 D1A9A9D83736011C 7251F9CA596F3335 9D8D01E8B9C7B245 F96CFF7E61191E7A D1C1AA869456A881 73D242F144758AC2 08B964B5B6A18673 2817524513EBF83D 4A334A5DE7E1A44A 0AC1F14E5B56632C E38EFBB5E1F0EC72 FBBB2CA65C3BC806 14777D040B5469A0 0D3D03E4FA4E6ADB 7071C7180782C5F8 4A95EF9192982651 E153B6B32ED6F219 1FB2083655F01CE5 DD6ABCE62007D182 B4A1376E78D8AC17 5E672CEBB2A3C0CF 2407929450367CC6 439C3DF9529A5052 010B2D62EF3DE94B DD14700720FE32D4 205F35BBEAE3B52A 0AB02ADBF264F9C4 0961774AC7315AC7 C998389DAA04CB5D A729ACBF0CF7C7A3 CF49480F7D1CFA2F FCBE90254C3D2F6A 55FC4930D5FBCF70 A8F640D852E7A1C4 82FEE7BF59155A09 643B1496375CB231 222C7DD84FBD8C43 EFEF24F956E62236 E45613FC10A7FA5C 5ABD0B887F8EA0B1 EF5AB1AF0A021F68 C984758B361384FE DA7C2D4D8A08DF52 1A9B78BD3C4B2F45 A200965188D9518F
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309131659 (name+title). Key = MD5(password) = e0b0c8f1ece79aa20c62d8e6a4347c9b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cf4f745c-add7-4469-8ab6-a9b727bd6ae3
  2 82719cb3-76b5-3c23-809f-6ccadfc90fe9
  3 46b75c2a-7346-4805-adcd-54fdb11e5bec
  4 053cf161-2285-1a48-8b62-6aeb8097d39a
  5 190d331c-c6fb-4ffa-8beb-9adffde00a9d
  6 6e2e91d4-405c-3552-9d62-f29bcb8ade71
  7 fd1de9c9-2485-1c35-b8b0-f73924c9be27
  8 7947243f-318e-4bdd-8ad5-d84741448750
  9 f765d329-1126-631c-9a40-74056cb71637
 10 5ea28e02-1fc1-8d94-8e18-0fe8a0bcf183
 11 5d161c64-01a3-1548-859e-a6f8289d05ae
 12 8bd4ef88-be5d-2e68-8b43-e05089cf7b30
 13 a81c0820-7518-32ec-a298-6b0dc2940d52
 14 357e1c49-3659-70c6-b364-4040827c5198
 15 8f240fc4-d74e-3bf2-8309-401b6ed7b202
 16 5cd0673b-3465-205c-b9c3-ff48f248f178
 17 93a74809-949b-1bac-bd37-29306b5ab26a
 18 74318668-cf22-371b-9810-f6a0da4cbddc
 19 8ef72702-a945-2a9a-be29-59229d41b54e
 20 8d778488-220f-29ca-ad7e-31b1aea282fa
 21 17975746-80ae-145e-8b52-69f67738eb1b
 22 868c94ec-ea46-8ed0-b1c2-076ebd770225
 23 b4ff9a2b-2398-3b25-9741-70550c5d3073
 24 2b47c932-0129-7052-8407-6000bb5cfc45

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 434143146812373213221837. Exactly this sequence comes out of new Random(612).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 28 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs