A858DE45F56D9BC9 archive

201309142359 1mezut

explained decrypted filler

seed 993

Metadata

Post ID
1mezut
Title
201309142359 → 2013-09-14 23:59 on A858's clock
Posted (UTC)
2013-09-15 03:59:57
Timezone
UTC−4 · title 23:59 against posted 03:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309142359) = 637d88f7483f291b2b3e43d991ef33f5 (name+title)
GUIDs
24
Filler GUID seed
new Random(993).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
59 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

799E952348ED80EE D5A8B424338DB5D0 9D55D4B2B0E9D9EF 643BCC7EE473808E 95AE537A0ECE4FD1 2EF06F75F2F555FA 9ECBB8F4DC7C0D02 1F7ABF3A100BE926 7B5059B8C4FC94C6 5E845C4AF014D287 40E0862108AC8181 EF2466E9A616D77F 7E59F88131F882CB 019E6FE9BD9A2D74 888AC9169A2F1966 9058D476DA80B59E A4934A0699774113 94E5AB590D6B0631 4DA1526A4684580C 651A6F1B155D27E5 60E3B13BB229C245 911E535D92E03654 D735410F42E5FC84 3A16CAD8A9F2D8F8 C988FA5F7FE9BD09 C2C4D6FACACFE36F 69812C14DE34DBD6 7EB91CC78EB02039 C3E59101A11C730D 4923C698F19131FB 09E08E2556ED6BF2 68FBF2E86FFA958B 196DEFDF339A97E4 20565A214996BE09 AD0E1BB363300D20 81E88DFFB8689D0B 77932B62CF3C8F2D 1A7C4014E87C5D1F 74043A969C4F1F44 25999B1B614B48AF 1733DACECE9BB159 D9EE23CF95F9A8AC 4FFCCDA7100285A5 49EE906E0ACCD218 3AD24FF321D0D64E 7B65C37140EF46E4 AB780C94BA8A08E7 F17D73945BEB9B04 3C187DE81679FF39 6403B60B499143B1 A268CA1F029F0722 360BFB154923E451 8A4FF397A024AE5F 8BFCDB6A61E1D231 4409AE6DE6FD6287 FA7939FFFCDE5811 45A92EAF9364F798 83451A1990B393A5 4B26B53062014BFE 4EB9626F4E92900C CD85715708287589 19BA31DEF35F7FC5 D2E811A324AC78AC 2A33ED54F3E0F430 7606C41F3A721615 E68194C9406421AB 96E7DB1573475E23 1A3F1B2FBD5AF1F1 9AF1C7EEC7E83B30 A8419F41D4722F29 2FC53B6CEDE57D97 3B3F7F0A4408EC14 0CB4053325D554D8 4DE9C9C890E6E5E8 1666E2AE6DB3EB0F 4A7BA9EB942644A5 8885F0EF61C7B279 803C0D0EEABE0768 CC25F4E2AB0DF12E E0389A053ABE5CA2 6B633DDE7969FA7B 1EA3C7A9D0B63D5B 9744613F71D20B0F 1D43782BF93FA18A 02C2F2081455CC8C CBFECA2C081D0324 EEA2FB56A65156BB C645B41FDA6BC0CC 6CBCFD299067CBC8 06019CA5E74D49DF 515B189F3C0CAB20 677140638CCF967D F2CA605EDD25E6E4 A4B195F4A5FA1A22 C514A3943B3D0061 A3819BBC06C7FF3D 55CD603520896A56
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309142359 (name+title). Key = MD5(password) = 637d88f7483f291b2b3e43d991ef33f5, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 41319625-321c-489e-86cf-c0c649f301fc
  2 90b7e3de-a990-1fdf-aa43-2b1a0409d3d8
  3 e6f4f0a8-fb00-717c-9661-e53c285ee035
  4 61efd39f-f517-4be6-919c-759a820cbd3e
  5 e8a9a300-e957-48a8-a9a7-95c7b8a93fd9
  6 e07bb914-2f2d-3252-95fa-27683ac02697
  7 700454a3-29b4-7197-943d-7df04046193c
  8 c688b625-4739-59c0-b658-20e570875a9e
  9 5e3d8daa-4002-7435-be2b-0f5542f58640
 10 99e38ae2-e63d-341b-95be-150d17485ce5
 11 69bbcfd9-bb15-77ee-bc26-411b8070b53c
 12 66165990-382d-64bb-bb9d-896d12a0fb33
 13 71d127e6-d069-28f1-a64b-2c17449480fa
 14 6f0a2646-b1cf-0d59-90ae-cc20a61d8eeb
 15 a61f9268-3abd-03cd-a190-93e7b8deb3cb
 16 d973a90b-a88f-1d21-a443-e6cf97e0ad8c
 17 518b60f0-8ca0-200c-8e43-103b643d7fbf
 18 3f012a0a-3e98-5cf5-8dce-089bf9a176ad
 19 25cbf4b8-358f-5573-ba44-698943ade62b
 20 7e6f2065-9d3c-7395-8d07-b282c97e24b9
 21 11c617d3-bf64-6944-8552-ebb9a6fdfc9e
 22 233012e8-ab90-46f6-9ad3-bce541ecc6ee
 23 f7af701d-cf5a-70a3-9929-a7b9811a5008
 24 01ebe3d4-6ebe-8082-8895-9727a0711e33

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 417443757376200125576478. Exactly this sequence comes out of new Random(993).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 59 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs