A858DE45F56D9BC9 archive

201309150559 1mfcyl

explained decrypted filler

seed 697

Metadata

Post ID
1mfcyl
Title
201309150559 → 2013-09-15 05:59 on A858's clock
Posted (UTC)
2013-09-15 09:59:57
Timezone
UTC−4 · title 05:59 against posted 09:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309150559) = 2a11733c22fe7c50170529a386121452 (name+title)
GUIDs
16
Filler GUID seed
new Random(697).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
65 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C4877543F854B447 7EB3D6FEBE42B75F FA6BEB8B9048D1FA ADA8CC3DAE98FD3F 35D94C54DC976846 5B3B2E5CFD836471 7819E439E922BF6A 31ED1454D6CEEB39 F6494068991606EC E9EFD5A1A2A1177D F2EBD1D2E7919616 A3B5110A91B6B824 05173CEAB69B2E65 4F42C279DA91E905 0C8DBFC7EB5E3B34 11BD7B4E804E1B6D 911C4B8B83B7F4DF DC585D78D6DBD4F6 6BE8DD3B20205942 37FD6833AAB3D3A3 81B619822F35F948 5F826467D9C1A5A3 BC1FB05BCB94501D DBD02BBA72E2B759 CEAC2A1CC8678ABD C8E059B97DCB5C15 A3108368D0C96255 18D5D38FE905FCAB 2D274BF28C4567FE 3A6AED52E86AF349 976B3DFD00F4E0F4 16B8702C5DF5C443 843F9F8031BC5AD9 2C582A92CE84DF8E EFB4577165743ABB DD4E880C80346FA3 879199B35A9C29EE CBE12BEC4F76CEE0 3B9421948F5F57B8 17D351BED8BFD9B9 6922F6F868FD85F2 9EB57E753A5F43F8 F3ED6E64DC30E285 7ECBBA9B6B6FED17 35F6639C62ACD822 BE5987D58208AAFC 3B478BB83A5F6EB5 6A1BD58717FCA9B1 0EED9C97DDA71B05 DA2B72F41A6CAA7C 3816A2293C0A6DA6 11D16D771808BA1D 2079B5646415DDDD 6017B2F0405C274A A7D78CA573BCB76F EC3EEE0636213809 26DEDDFDC92D76FE B2F3C985F4B6D893 D4F3D9624C96A425 9C3129370D2C16E6 E617311C6E0D7085 996786843A386624 6E64CD0286B3D9E5 36339E4886297168 3FD27E26057D7864
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309150559 (name+title). Key = MD5(password) = 2a11733c22fe7c50170529a386121452, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c496053f-5289-7075-94cd-7ff40d866107
  2 09e50fb0-f41c-2f9a-83a5-0373efe2f0cd
  3 9584c26e-a5e0-8644-a789-bb5173d68dd9
  4 5eab5518-0fa7-2412-8ec1-19c753606eaf
  5 e65c45d4-8b44-8b2c-b36a-7f8819b43b6b
  6 581b075e-d0b4-5a8b-b062-ab3e661ec1f8
  7 70430c55-c686-1095-90e8-bfa1ca87344d
  8 eb0cadb5-6442-1908-bade-3a5c4dbc1dce
  9 0ecf57e7-4992-1e71-ae92-6a2b658c44ad
 10 60631b9f-14ef-2820-90a7-69df3a621fc2
 11 f1ca1e25-e4d9-7e67-9b1a-ad1c02050a12
 12 1074c95e-1003-5ae0-baea-6838fe95b1b2
 13 9f60445b-47ba-76f9-bfcf-3f0a7386a935
 14 e030f38a-f8f8-0b48-9e23-d7cfd525eabf
 15 84387cd6-cd4f-782a-ac60-28cef39d55db
 16 57b823da-ece6-2b94-bb89-b52716257e50

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7282851112757072. Exactly this sequence comes out of new Random(697).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 65 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs