A858DE45F56D9BC9 archive

201309170632 1mkbw2

explained decrypted filler

seed 305

Metadata

Post ID
1mkbw2
Title
201309170632 → 2013-09-17 06:32 on A858's clock
Posted (UTC)
2013-09-17 10:32:59
Timezone
UTC−4 · title 06:32 against posted 10:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309170632) = 3c5c577daa8e4ed1ab98ed857253dd6e (name+title)
GUIDs
24
Filler GUID seed
new Random(305).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
104 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
11 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3FAA5FF608A11896 DA5D2387AFD4ABD0 764602A437F3C746 A03E0EF65C9BE09E 43CBAAC7687E673F 6B9BC2626F8879F3 5FEBB788971DC9C3 BA516EC57D7DF5A7 DBF2C52B34264529 C27BDA13623BCBE5 2F59A1BED5AA8CEC 5EF327A59072F497 8EA2F2449F8FEC50 809A7D733387627D C4AD2B1783128A98 2FE3B4106D36348D 219148AA75675AB0 521811020333D66A 973B8D8099280AD9 DB0D352FFC9A5E03 39CAD4DBF716D381 32413893F41C9E77 87FBD115FB165B1F A15781843C6A24E3 97667BA5D6C7FC82 DA31FF1626CD3DA4 6322B17F18AFD76D 3DBE1851DD61063D 4A4896F1F1052D0F 9A51595EACD59960 3E1B9CF79B69D982 27C88157D916EA89 1277D5C43AFBC5D4 2290A8F74B319DC3 D48FDEA920950EC8 79FFE5596A48C7E0 BA1C2E5B0DB3C416 7F3032F6731F033C 824EA717982ACD54 4D348054A41592FB F2B02AAA25D463E4 D93C31E1B7B9DD75 DD952A0CEEF63ACD DA2ECC7717289EBC 052CBC8AAA5B9FB4 DD7768A8F50774E8 D5210B484869C4DC A6980C45B7E3114B 65F66A87DECB1F0A 549C81F74DDD5CE2 E1BE2E6A7CBEA4EA 9B0AD43DCA1AE35C 7C17D95A172272DE A321331AD7BF7196 DD9151023B326804 5C79E056B2DF2C8F A5256F04365E6D63 6B57C37D42E7DFB5 5BC6277C058A0DE1 E7C5B83CBC2D4F4B E5330C4F2232B231 44967653F7AE4821 C7674745A70AD41D D051F1F52C065B3A 8F69C0CF1C457F7D 6162F7059EFA426A BCA82683D4D33AAA E51E80E0525B8F76 402CC5CC36D135E1 EF4BEE099AEA848B 72B32F541265B32C 9277857C19C0E093 AEACDEE9FEC1AB52 EE7F2A927A57C1F3 06279EC9AB06C189 25B0710085AFD947 E3552A54CC9AD2A3 D18BAA22DFC89AC0 B327C9A086B254B2 38F3764647B351C2 FD35618415680B38 4D655591A5327246 0D6DF7B34D9E1112 ECF2357B2F2E3DC2 6D6F50713883A9CC 32EC98412D744991 477B1EEEAF72CF36 3AACE81C12378492 CA0F32A80C89FAD9 9C4F9E5CB41493A3 86B7E346A03FF12C 8E29DE8E883563B2 B0A6C9F0B815BEA4 22970778B9058F38 02A5E0129BE0CBD0 7E1B1C148D304F98 33F9D9D6BA398D6A
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309170632 (name+title). Key = MD5(password) = 3c5c577daa8e4ed1ab98ed857253dd6e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4ee50c88-1e9a-09e2-bb91-870ae93d0e4b
  2 452b0be2-aa11-211d-ac10-36d3fcb3e082
  3 6aeba8d1-6b4b-8d6d-8efe-329b11f73576
  4 166cd527-a202-5911-898c-f3bbd3ada870
  5 281c830a-019e-8fd3-a82b-c30090b7e28e
  6 42ceb2c0-f323-0cda-8777-7eccb6145140
  7 54011b3b-2829-554d-84dd-f19e6b0415e9
  8 a9eff64b-776e-4fec-b2a2-0a3151d82361
  9 e6eff396-0390-6ba1-be53-325843c7ece3
 10 e324208c-06bf-6e23-bea7-a7d1980880ae
 11 1d98930e-4f9f-8778-9e54-89434cd31e16
 12 62180ac1-781d-559d-b5da-81f9a5339190
 13 4f0f9a3b-a586-219e-8d57-62f18846bd1c
 14 2875c4fc-a24a-1e23-b273-e02e16f4aca4
 15 190df944-8a72-4254-ac68-097225238d35
 16 fb5ae271-15da-49bc-9236-2b1801780f34
 17 a5a8b566-f105-04e7-8a87-5677c4db5463
 18 f80dd30e-80e1-0bf1-9a7f-3eed00734ace
 19 1b90abd7-d2bd-8ba7-b050-9711010157a3
 20 28aea425-a045-35b0-af9d-2e943025c59c
 21 f3d8d1d7-0646-380e-8d3e-881a6fa90849
 22 a88da5ac-fc29-653a-b1db-1702539b524e
 23 00c9fd16-af16-42b8-9ef2-935f9513c9a2
 24 bfb37c9d-3a63-5ade-a2c6-aae6da3431b5

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 028580546685214400833645. Exactly this sequence comes out of new Random(305).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 104 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs