A858DE45F56D9BC9 archive

201309140559 1mdbhj

explained decrypted filler

seed 14

Metadata

Post ID
1mdbhj
Title
201309140559 → 2013-09-14 05:59 on A858's clock
Posted (UTC)
2013-09-14 09:59:58
Timezone
UTC−4 · title 05:59 against posted 09:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309140559) = 1ce2a62b692bc1a7cbc4f2ff9338ac6e (name+title)
GUIDs
24
Filler GUID seed
new Random(14).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
41 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

434D772239B740E8 4FFBBC734C8CC837 04DB9E34B6A5A221 B497FF09AB4B7E65 D2CCC0CADC6025A7 97630EB8A19F74B1 67FC91DF2CAF2B1E 5323AD85DEBE45D0 B94A0C0CBA332B67 BB3D1425CA4A46F9 B2A4785B3E22B59A B0128A50826CFFE0 2F8B7C806ED8F855 7D361810F011546E 0587E4BAD01B8036 79405623F9230338 B4419F6C7DD0E058 AF2BD60CCF1A180D 6144E28C2664E738 125BE6BAE7F56D87 B6A48C45C2279587 EE3D79528A22E786 554BC5FBD68CA41D 0C18793F112A6872 60930F0997E42F12 CDC2F5F7F020BBB1 CE6D11A456C50859 0581A5EA8DD53C6E 02EE9A7660FE59CC 8988EE2BEDC0DDFC ED9BA6C029B47F06 299A2432B48440E9 C2B5765591BA6427 4BD02D6D093EBF3F C76F1A9940E7A732 F90B482B1857115D DE77A0832E427399 2EFEC34D63914F31 6EBD003201D41CB5 6AD4F5BA2C77242C ECD0B822288D24A2 5921AE0FC3748B62 590321128A16497F FAF4B0B10443D7AD 835BB5A98714806D 97A40B652960483F D86C8A729B075AD4 9743ED218F7BD2E1 DF39B8AD38615694 2000FC52C1F09049 C0691748EA86E6CC 98E4C277C96598D8 B766313194517A27 6DA846ED0FEF42D1 9BAF5849C086D34B 8BF6ADC1AE37E725 CEBB542B1B8BE0F7 569C0C4F62FEC0E9 B898388073C0533F 86A9E349336559DA 6B586020B467FFED B4DCF1C164542674 968ED5B5DAA00C01 2F70B6CD7CDC75A1 E0B4EBC0A8C89AD7 A03B24E355C36D19 0305503D5B3F1BBD 425F8E8EE6801CE7 CB55F6BFD9ECA9DD 215D7A050E09C2EB BEF81E7FDFAECCFF 018BC1FACEF0BC6F 8264240A3DF481E3 CD89584C94ADFCB3 6D34E52A148BAEFB 9EF5419D29D4988F BF50599832AC59FB 232711F686AE7B74 18C33271A6934CB9 114170F27384F22C 3208DA75412810D0 D619C6C68A0893AB 5CB3A24633DB479C 168AC788C50202B1 686639CFDD2E281B 5E5124197920DFE7 541AFFAA4360CA1B 7C719676D386BD75 D587B4FED98D8179 EB025AAB51202115 A5409B8DB8F46CFF 2B8B35CB84F2D2E9 055DF9F4D6FF845C D952A334E3721D7D D16C6DC3B1DA93C1 66098F927D13952C 134AAB2B6F0C83FA
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309140559 (name+title). Key = MD5(password) = 1ce2a62b692bc1a7cbc4f2ff9338ac6e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b7638d87-91ef-0e9f-9240-20aa6d80cef7
  2 a3ffd7c4-07a4-8340-b736-4587ec135920
  3 5c9b5209-8da5-48ab-9b43-b24ff55aadaf
  4 d2505b33-08bb-47c8-b115-4af015f428d8
  5 04a84297-37df-42ec-bda3-3a4800f5b6b8
  6 fe167083-a3a5-79c4-aa60-6f3b9a1d37ae
  7 46482c51-489e-1857-b851-1bb8473f74e0
  8 ec4c09be-9da7-4911-948f-bd6f70e8a5b6
  9 5ed9c855-d3ea-601e-9acf-9bb071ec88bf
 10 cf6737af-7ad5-3394-8fc6-fd898f1b496b
 11 3b82e375-1a95-5861-9fdb-10b20d4a0ae0
 12 71e2b948-ab1e-3a31-b53e-941ebc884362
 13 f38b8911-181e-2e58-a23f-bfaa89dec7c7
 14 1860defc-2c91-66b5-a3a0-fc0b09761246
 15 5d4bae97-cb1d-723a-980e-14ac89e09906
 16 8e49680a-3f7b-6ec8-b877-704c24d45c57
 17 ea0f45b2-8db9-6990-8cd8-3e66751b2d23
 18 f0cb5a3f-ef31-63c7-a0e2-d3dde64e2613
 19 34baeb69-0c9a-0ba9-9b29-350334708f7c
 20 3deb4176-2888-6d0c-9ae8-24ba4c64e2cb
 21 c13ed39b-8c68-6649-bf41-f1dd9eebb21b
 22 4c5a9783-d884-23ce-8492-2729d3302b7e
 23 94af392f-d097-39cf-bee3-dac822f24bb1
 24 20a82574-540b-8602-ab45-ce3353d7c8a1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 084447146353267666066238. Exactly this sequence comes out of new Random(14).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 41 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs