A858DE45F56D9BC9 archive

201309140959 1mdj8y

explained decrypted filler

seed 735

Metadata

Post ID
1mdj8y
Title
201309140959 → 2013-09-14 09:59 on A858's clock
Posted (UTC)
2013-09-14 13:59:58
Timezone
UTC−4 · title 09:59 against posted 13:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309140959) = eee93db83e213b7f955d51f590441b40 (name+title)
GUIDs
24
Filler GUID seed
new Random(735).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
45 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

56E1097941783BD8 EDC943D852361B24 4CF7CD44D534DFB1 4F9BE3586241612E 30D25F815E3C06BA 6D4125E393AE06DE C66C4267893E3197 0C0E98DBABBA48C6 D53A4C8F1B4D646C 6CEA6E6679CB2958 8CBAD41E2AF6DB01 1A240DAC8BC19E74 8704D7775AD7C042 6BDE9FD2A606F2BB 13F26FE21BB90ECD 231B87BC6063AEE6 780DB3D5847A4865 830EC3F61F1B02D2 E55553EFE11D5674 906A769DE111CFF9 809DD933CD853A7B F2116FB71315B75A 2CE79E81227877BA E4474B9E639C2AA8 9B6E987EC4B8E749 9BB919D5E16FC0B2 422478A3E9DA8178 70168F33A5CAD540 AA1642F865DE28EB 65BD8A1E5B844316 0A3215D3BC6C9E83 A9686EC979141367 DB30F425A7B55DDA 240302AB25657B2B E13F618AE2F3DE68 94DF9AA015CC02D5 D2791E84F4F3A6AB 8EC58185900D1309 B95BFCC5DFCBB09B 324F5C75E5385E91 3EE2B90E44EB5817 8A12EF3C053AE646 84A910441834CC08 70B11CC0BE7424C2 995CE2C8E92D4E21 8BCC83BC77162C9A AB508F9E1F9916CB D8236262BA220F24 B18434CC3F35092F C4F5B0809B469CCE 3B11CDC7EF762EB7 1F91CBC54EC5FFA9 30FE81C784DAAEE5 047B395B6E157059 6C80EA8292F78D60 D50466A5DE5F20CF 811AAC8E2519D131 44FEE9E236CFD951 6AEAA68D6AFC2819 92F27DF4E1537DC5 CC9197E844324F10 F2BFA16C26C529C4 8A123800E90D041B FF8DC7BBFFE19EF2 74C58369B7F967AC 7FBE1880DB88756F 0C87F927E02633F6 0299AF0E0F00568C A7A6164C48D08060 FC86372873EE1984 181C85AC181DE2BA 8E6518A880DB58DE 9AC9F05840D29F70 B61D52CF973D323B 4ABD0D0AC48D9AA5 29C9CA2D706A9AC1 3DFDADF235A6F7CF 5220D2D5BDF4A583 A6C74F9093275DF9 927C68BC9F78913F CE0FFDCF9A3EA7F4 23057C67278181B0 ACE566A32B74DDCC FC31F1C464B0870A 255F06C5B26DE5B1 9FE5C9022DC58B4D 5831BC4CBBBECC8B 810C750786169598 4A2090F5E327E5B0 2A5100CADABAF07D F0081975C17BD55A 7FAD1B4C018CBBF5 1F8B55D2A64271EB 83113AC9C31CF374 A36229C1F01DB90D CF2A9286464D75B8 96858D7FCCDF850D
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309140959 (name+title). Key = MD5(password) = eee93db83e213b7f955d51f590441b40, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 612a3d11-b0bb-6306-a4f7-0490f9810e18
  2 72701d33-0cbe-4a6c-84b9-fa8cdc474586
  3 517999cd-fd3e-48e3-8189-9b1ee2641249
  4 26aa5f24-3912-304b-b382-58245dcdda78
  5 9d4e5801-5cfe-0b75-83cf-1cedc0057c0a
  6 8c72fad8-be3d-7a77-a154-9c394742a0d4
  7 bdea400a-26e0-2499-9caf-10ec9e2c2935
  8 54f52f70-8594-1130-ace2-7fb9090b1bfd
  9 e5333c47-9d70-857e-98a6-4f12386764ba
 10 b36d43a8-9cb0-2062-bff4-1337ac45bf00
 11 363260c3-7df9-7bd4-9aa5-de1af84c7571
 12 8cd4815b-b4fc-2a85-b02b-27006cbefa97
 13 0a5064a9-e55d-8bfa-b96f-a3130222f7d1
 14 47baa548-54a5-7311-b3e6-7b0165d40cf4
 15 e5882b2b-d350-4f6f-8385-1f601acb3cb7
 16 260bb01f-a373-04fb-97c3-a5b5a5c0b91b
 17 77cbab78-8b90-72c3-8927-158ef7305391
 18 b3894eec-4550-66c0-b8d9-c30dea1b7320
 19 a538d7d8-7ddd-5e96-be40-e2d096040f8e
 20 de02d00d-418f-8a4d-b192-1e6e0843762a
 21 08a04b3c-d87f-4ba1-9274-dcc245209a74
 22 5ad348b7-3fd9-139e-b797-b51f5961c48e
 23 217104a5-510b-1c5a-b63d-85b5b344bd08
 24 86dd96b4-1c08-729f-8dad-2f67d37ab8ec

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 644307218272874076584117. Exactly this sequence comes out of new Random(735).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 45 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs