A858DE45F56D9BC9 archive

201309160059 1mhdlh

explained decrypted filler

seed 611

Metadata

Post ID
1mhdlh
Title
201309160059 → 2013-09-16 00:59 on A858's clock
Posted (UTC)
2013-09-16 04:59:56
Timezone
UTC−4 · title 00:59 against posted 04:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309160059) = cd56f9ba03651ec76bc916b265ce046e (name+title)
GUIDs
24
Filler GUID seed
new Random(611).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
84 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3FC7C9E70EB4938D 617C01E23AD0893E 16074E35A271C392 2CD0A1B8038CA5B0 908730FAB7D65C21 BD676E3608C5B133 E587E1064D0EB4E9 5CCCD6D5BF8C67B7 553C12693E88BB8E E52103CFFCD1AA9A BCF58F70BDCE2F6C 85CBAF1F1F42328E 4746AD26AA79A8EB C9E2B6C77B8E0114 19BDA10BF2C1F647 A101018E2B7EBF5E ACECC4776A4A7303 E707CE1EAAF8E9FC 339CB3114B9D15AC 711C2974475E1946 471FEE7FDA956EF3 AA20DB1CF497FCFA 549FADC08341FBC6 813A0030D2F99A7C DD824D91B0FEECAF EC1887C3A0806264 8BF67F0D25171043 B047ECC6D6E7F08D EB27DB65A09087D8 4064C50F64008984 BEC55A1CA14F572F 07B15F05FA83A6B9 B8F65CA548D0CEF7 19CF418E28EF764C 4978F49B29476F33 B311AA8E891585FE 356D34937F9F0ADE 7390C18600179A86 7E0FCCEF4BC93C04 FA6BDCD1012B9445 0CD38E93EA47F696 A9FD0B691885D95F 8343EC3DE487AC2E 8C986A8C8CB31622 8B48AEE95BD36D11 862492CCC362B4DC 66D43FAF44451905 6BE5FF456DA64B3A DFD76EBD5149C76A 2994B110128B6B98 86958108A05760B5 13037A9CE783C0C1 DB708018618D00E8 EDF0C690089E1A94 2BCF8A98567F4246 2CC3E70B4D50E338 2A30C81AD2A7C213 A042B4ED56BB15A6 FCBBC11497B66E0D 2637FFD8F2707C36 9466DB23B22637CA 8D4619BB563FC7A4 E26BA00234018EE3 4D9F31FB5A34ECA9 688CEAE5959EF74D 7926FEACDA35BEE8 634BAD90F7A1B985 AC10DFFC8310EE4D 54141DC331C8C1C2 83EFEDBBC9F4B37A C70D17C2D4E8A4FE 11733FFB0E56579C 42AF73128DCCDD29 AAB99357BBC97523 8C7F79BB394BFF7C 233F3FB05CA6DAF2 8E1E67981EC5B546 8A24590660DFBBAC 6AD5B96CA7402479 EAF82B49BAF4439D 8E53183929E2BC6E 3586077D3C0522A6 06648B90AF68AAF8 06E08B14D62D7311 40DF1D7E2371DF5E D4973EC95C67D103 2A4EA624D23ECC44 146B9902AABC4019 5D8E7120BD4D3368 0D08AAC9A6946EEF 672F94CD1B3431D4 F01A0697D6CC331C 201C0598316A794C A78EFA77B8398AB4 2C3C712249C20BFF CD4FD34F2E4A20BF 02B969E1B98573F4
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309160059 (name+title). Key = MD5(password) = cd56f9ba03651ec76bc916b265ce046e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f1b81225-143b-8063-b1f2-297e9465ee5d
  2 52525bcd-e104-0bbe-ad13-4b2edbfdd894
  3 9b3625de-dd21-74d2-bc8c-f235799c079d
  4 21d83c87-14d6-875f-a22c-2e2ab814afc3
  5 802d3721-d94b-017a-9cff-33bde5591449
  6 9e8b2bd7-c92e-44d8-8cfe-c2b331a10961
  7 bb4b12f9-3838-6762-9207-ca62a54a5822
  8 35049cb6-5d37-8577-94a0-046c94d51e38
  9 661b4c12-37db-5dfb-b13f-de3f3c61b159
 10 fda11bb7-3872-5d5e-ac74-a0caf9299d24
 11 22b08ce7-11b5-3b36-857e-93add98c6c25
 12 a00ed1f4-efd0-4803-9685-a6bdf70e316e
 13 da5e3e69-95c3-5230-877e-aacd1e773764
 14 e070a4c9-9777-37f3-bde0-27d20640b1af
 15 0d9589f5-34d9-5cb5-827a-58cbe62b2ac9
 16 74f55fab-e977-5ebd-8dd2-3fdea92e5383
 17 223db091-cb22-60ee-b4bf-9da592dff67b
 18 f9d14d0b-9116-770d-95a6-ca0130fcd32a
 19 1496e263-5461-1ad2-a57d-4e59128f3126
 20 bf247449-608d-8a02-981c-52f4657b1582
 21 21fdcbc5-f2e5-06ee-b22e-5c3467580f52
 22 efea3186-cd51-69bd-af31-00a1d087aa26
 23 7d378017-7047-2912-a170-4cff91cb8e99
 24 7449aff3-20c7-46df-900b-c48e52685b64

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 807804685534535567180624. Exactly this sequence comes out of new Random(611).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 84 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs