A858DE45F56D9BC9 archive

201309140159 1md40j

explained decrypted filler

seed 130

Metadata

Post ID
1md40j
Title
201309140159 → 2013-09-14 01:59 on A858's clock
Posted (UTC)
2013-09-14 05:59:58
Timezone
UTC−4 · title 01:59 against posted 05:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309140159) = d145103843385183b65f9aa6ca754b58 (name+title)
GUIDs
16
Filler GUID seed
new Random(130).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
37 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

0D4A4433694DBE96 30AAD8850492B360 1D08DD914374BB2B E3C5FAA7A6484616 7BD2C411E012EBE7 05878E7462D8E251 98E1ACDE7E0A1FAE 9AEB96FF6BC2D8C6 0D5BE34F4FB061D0 DBC886E5D1ECEB7B 93A92133374826CD D3CFC9F8D6E0F9E2 D1C6B3C750E5643C B751BECDE6F59F95 C163E372A825EF96 7AA6D6E870E0F0F7 2D2F87A60AE81C59 8B480529A0B638D7 DBDA72BB152506E8 54451B8738FC8F9E ABE216F9096C3513 F0B51843E64B1A94 7782D447DB2ADE4A 4A4D9597D6F15891 CED3473F153F47FC 2281F65436D43C27 D615B1FBF92838B8 C89C75CBB3BCE1EA 99452010B005712F 4AF4EFD2E393D54A FA980F388BCB4A86 211032C98CC4DAFC 9DE7C341903A0D33 2045F9C1970D6173 7782D61B4AFFE889 90CD51532564EF03 1D244E0BBEE3C3DD F63C025E51A05D6D 2EF154A346F99CA6 1DB1D86E7E894DD5 ACC43F1FD3968779 1827A8D6F3C66FC7 1C6654351B787FD8 61DCD6175FF6BCDA AC1A77F9C0D3CF3B 7D9DAD79B46402AD 40D031862334DAEE 42605C6F472EE195 11635501AAEBAEEE 9CDCFD0FF2437C28 1006669FEBF616C5 8DB196E079B6D622 D8398560B69FDA60 917FFE907278956A 14719C4473F4949F 7F59B08E0C2B9C4F 2CE737B4B30037B9 29066CBDCBDB7BEF D138BF39AFD184E3 5DDA9D3D0D0EC4D6 26D1C75663BCE430 D14EE9403E27010E 5168EDA174B91587 6464A7C65C6FEEA7 76E22F48CAC995CA
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309140159 (name+title). Key = MD5(password) = d145103843385183b65f9aa6ca754b58, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 23def81b-60e7-5f94-abf2-8185c9edd270
  2 9159ef65-d1a8-8cf1-90a2-b9a07a6ccfbc
  3 0dbfd220-3fd3-5d61-a81e-0026baba4d64
  4 f2880a64-4a30-2703-a316-1f46e2546060
  5 b7c12766-6d79-88ce-bbcf-33889485fa2a
  6 deabbdff-a0e5-142d-8089-ffedd1dc783e
  7 631ddbda-6600-13df-b4d2-90914ad663d0
  8 4d1a9242-200b-5983-a15d-d1f4a257c864
  9 a939c873-b9cd-0e7e-8388-e529dc43e04b
 10 129e4285-3dd8-1a74-bb70-060ded2a5873
 11 9fbf6c44-a42d-0149-8aae-807e3a776aa2
 12 ba566665-9439-8b55-8c1a-cb501b58cfbe
 13 d3e74f0f-b5d4-0525-ab3d-486e545b3410
 14 7ff66a8f-81c9-00b5-8974-35862a9acf83
 15 c7a9782d-1433-8403-b7bb-3dd918caccd6
 16 59d2255a-e50e-15ad-9ff8-b17f13d99d5c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5852811501080081. Exactly this sequence comes out of new Random(130).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 37 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs