A858DE45F56D9BC9 archive

201309150959 1mfkmp

explained decrypted filler

seed 465

Metadata

Post ID
1mfkmp
Title
201309150959 → 2013-09-15 09:59 on A858's clock
Posted (UTC)
2013-09-15 13:59:56
Timezone
UTC−4 · title 09:59 against posted 13:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309150959) = 7b7fb67eb9f73e7c229f137653f6ab25 (name+title)
GUIDs
24
Filler GUID seed
new Random(465).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
69 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3FDFDB2BEB74DD31 9B95B45435978E63 5461BEA90287B3EB 7134D65F69F6C838 E2FCD67AED878EC0 AF0057BDD5565117 C0BCD86D2641D1B3 BBD8DA86A57B283C F1505DF6BDCC0B89 2E5158CB9FFBF113 817476A6D097091B 81102CD7889EE975 09DBA6D87B96CDC1 70A81ABE157CC9E9 872FD5873B8D3CCD 1977894D15853AB4 6BF3763CD91EEB4D 47450FF886693CF9 8C896621AD92609C 22C1BBFD91728E13 BCCC27B64598F06E 7738F1FC42E5A2C5 3A1AD3B8681AB982 DD809C02E53499E1 322756B40035FEFD 138C183357207AA3 60580687F53E0E0D 761F06CFF7A5F852 2CD11281FA80B582 E029998FF06D0EE3 E345384646EEF3C9 F8AA23A9FE016B43 F615EB558020B4B3 ECF9893382550458 C30D6F24C6847AE1 ADC8AA22AF2369A4 4DD5FDE9F88E4AC6 928E1058E001BBFD E3A4D9CCE8F7E7BA 75680DDAE2378049 3240C8F69103B728 3003D5987916E9AF 46E6ACCE4B23BE84 F9C08393366487E1 8F05E18FE917ADDB 06DF570438A286C2 4363C1225F9B9EBD 3C3CDCEF32568685 23A2EABDD625A503 871C72DFE96A5C89 7EA10899712150E0 B6C42BF84C237B7E 165641C5B481744A BD45598DA8076CC7 3A00F4F857BBFF62 1821037F41D65F96 5547E68CF8B799C4 FAF9C3610EFF3611 FFE5D50ADFDE5863 3243A9363F919435 247A2A542F1FE252 79A2BFEC714D8193 8A2E862FE6BEEF87 43C53F329895F02F 7460610FA742FF51 DFF6E8DB675BEA9B 8B83B4273E3AA774 B3FE645C099C29BE 87413B7F805A0DB7 796C88A312315FEF 3436455676810907 2EEB9C8B6B751847 14E56FB9DB3E08E3 AC6F28F9F61636E1 87D9C5F0B6208F68 4FB1B84136EA1D97 7AF4E6D516A1E39D 7E95DDB1A8D1FAE8 A635D395AAD84983 AB1C274C115CEDFB 038D5C19B93ED8F1 491C7C0948F7C5D4 34A01425C5F5CA80 DDE1F91864311AFE 8A3903EED376BEF2 32F3D806E94A4394 2621A48A60961719 958F4751E02B9A4F 412C2237FFC0840F EF32574BA571BC0C 1C8825D17CC7A697 5FD44F238443CA9E 74B44F890B514194 FFB9E587930798C3 B82DAE20B895C67D BC3F8633657B88D8 861A93CD2AE822BA
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309150959 (name+title). Key = MD5(password) = 7b7fb67eb9f73e7c229f137653f6ab25, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 36880ba5-f09a-5255-992f-254b5cc309ba
  2 2647f668-c90f-2ea1-a750-73109a866a5b
  3 1e4845ee-03cd-7d60-9266-2e654025d593
  4 ae09d419-8288-7629-9962-ff20eef8d42f
  5 a5fa27c9-6d1a-1330-8b97-98a5301d26bd
  6 7c19b1a2-5b9b-838a-a862-d855fe3697d0
  7 aae2077e-54b2-2f20-ba00-e1aeebfab135
  8 98d7e8c3-bc6d-6f3f-a0ff-b870ebc24fa2
  9 de864254-494a-44f2-9658-50fdeee5d9c3
 10 abd7a59b-4a65-69ae-aed2-c5ae94d3d502
 11 311aea58-0bfd-7c82-9129-23c3e19b780c
 12 7489a14d-4bfd-495d-8865-3bb0d6b06f2b
 13 cea3361b-3d19-21fa-8394-a05e1027dbd2
 14 6a68a8c7-e4fc-3b0e-a5dd-675c163cbf04
 15 95a42626-e9b8-422b-bce2-85390adeaf6f
 16 af45404a-ffe5-39a1-bc44-f82ce428f217
 17 da485894-e59b-2709-8959-d538e0938006
 18 1f578862-47f3-2994-b127-9d9f97b18e7a
 19 9275631c-9b9e-2c0a-8431-4ea9c4bc392f
 20 216f857c-48d2-3b3c-b886-cb2bff0df6e7
 21 3e2896ef-7885-579e-a43f-86e09b9d0c73
 22 e39768d0-001a-8a26-a25f-5571390588b0
 23 e7e7140b-0b93-5e6f-bbe5-41dfea1df31d
 24 440143af-ae94-4fe8-953d-ee3d4a08bb88

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 527718264674234322235854. Exactly this sequence comes out of new Random(465).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 69 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs