A858DE45F56D9BC9 archive

201309161659 1miyv9

explained decrypted filler

seed 796

Metadata

Post ID
1miyv9
Title
201309161659 → 2013-09-16 16:59 on A858's clock
Posted (UTC)
2013-09-16 20:59:55
Timezone
UTC−4 · title 16:59 against posted 20:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309161659) = 216f889af0113520091806bd7d841d86 (name+title)
GUIDs
16
Filler GUID seed
new Random(796).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
100 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D5AFECB8BF15E744 DD9221A629B0937C B504E4D3C5E5A084 ADE25AFC217D3E99 0B1C1B36B30F7F8F CCE754C9EBCAA72B E4B97F090032A446 E296972A8E99A93F 48D134ACC8248226 AAC477E95A810436 1C987712956856D4 F1652DF1E2ED52EA 2ED989200F3B5FC4 7DC6A237BE9C857C 46B2A84D2F589877 E3B398C051016C4D 51CD157A41578F0D 443D122007837437 815656C8FA396A6C 5CD431AE2AEC81C3 95F8AF50043EB8B9 9C9118024CEFA2FA AC84BCE35C8AEA28 4E030E81431F2C2D 96982D1AAD7AF13E 054EE749CE57448E 7E1F38CADC95775E ED4E2A6B380B7FD5 919B5B2CBBCC3ABB F859B4B0299BD798 D9AF2A89C0C1ACB3 5CCE39897B2C8B55 EF1C4418B00D3098 465B184322E494FB E2ADD95FA78DA0D0 58F42AB01F5FF57B 8553343455E8B712 22BB2FE4CC2FA5E7 5FC31D95ACBAE554 29959E95D2F16892 EE44389287F621B7 8609B4B068883B4A 81576B3F522DE45D CFC72C8E88A185F5 788F0BA4E40A30AD C6D802ED1D9266EC F1C5F4648B5D441D D3F62B8080CB3D2E 8FDCA0D90F918208 59ED65F19F8E91C6 6E66C83E4C501B06 2D07A0766446F325 32E53BEBC83ED561 0751643C026BCAE4 76C0193C7DC204D8 C6FCF90C830BFDBD EA4B7049CE474B61 D1539F9E2C53835E 497C46473A870104 E10F67801E9A2DF2 FAA22B84C188ADB3 D575951AF36C3ECF FAD1273C8A6C8F74 FEEBA9F209062048 53EC4E005982621C
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309161659 (name+title). Key = MD5(password) = 216f889af0113520091806bd7d841d86, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 081cf2c2-9269-5643-aa8f-98be2efd70d4
  2 75ea7896-0bd4-300f-ab10-607aad5b25aa
  3 7287aab7-07a0-1f2b-8fac-b9be5542f302
  4 6ee5e3b6-1e1b-4faf-a1d3-051eebc2269a
  5 65e08ea8-0fb4-556b-8abe-6e2a9b50668c
  6 3c544cba-43b9-17be-bbcb-4e51c99c9b6d
  7 7d090091-1665-5a2a-bf04-d7206a1e4d83
  8 e74789f6-d263-7a09-938a-a1f5151f64b6
  9 a6105d7f-223c-48c4-b1f1-5715222439e3
 10 42226bf5-03d2-7ac2-9c86-7af985e6392f
 11 94334e99-e539-6e56-a777-6e9bd6a6ace2
 12 258ed562-0c65-8ccb-adfe-eecbd161fc97
 13 e11a0718-65a0-780b-930e-4b9fd35dd2a3
 14 9c8e5d5c-e85f-5333-83f6-d5cf3a1e35f6
 15 c5ef1daf-ac4d-1945-8268-df9c24db82ef
 16 5ba25099-cd63-18f9-969f-b87648f27e93

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5314515747687511. Exactly this sequence comes out of new Random(796).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 100 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs