A858DE45F56D9BC9 archive

201309190032 1moxez

explained decrypted filler

seed 132

Metadata

Post ID
1moxez
Title
201309190032 → 2013-09-19 00:32 on A858's clock
Posted (UTC)
2013-09-19 04:32:57
Timezone
UTC−4 · title 00:32 against posted 04:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309190032) = 28eadf46f996f3e3e7be7a2d18824d79 (name+title)
GUIDs
16
Filler GUID seed
new Random(132).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
111 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
10 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

483A238FBE91356B 73C06BBF10222398 69DFC96A4D891B79 C42943A2E0C08F3D 45EED5C01125A32E 4F8EB484D666B3C7 04877068448C2016 9E38F236424A08E4 AF5AC13ABB692FC8 FCE1404CEA5D98FA 388BABE1F77FF1E6 6C0585DF9A830956 92F2D17D36E58BAD F3663691CF7C7CD2 2A2C482D02C0AE2C 3DAF3634809DD896 2AB4D5FC25F958F1 52D8E78A970B7552 3D36850F022312DC 7DBD69DFCA88FEA1 0826748CF17FC91D EA330DA08B8BAE35 ACF8D6E9CA7A0E41 EA3C28814A840659 958810FC712D7AF2 0A228DFE943ABF66 85503FD031867229 E09732E320C93706 2420850C11CC1C6D AD4B4D3B4E500D75 A84253F02FFEDD54 C96C0D4ECD041283 263F40D05CB4FA1A 64D1D7DB22BFB8B7 E3E5210CC1E5EB1D 17DDBC3FC63C7A22 4D154DEC698DD51F 197D54AC63EC8412 E938DFAF4024935C 09AAE6AB2FD1582E B7B2DD258E038125 793C1E0C8E0C02E6 7A7176C4841D1FEA A010EC88398EB28C 02AA3BA0148B2480 617E8555B07D5C3F 64EBEB0477F3D05F 8B993994A9D07939 CC239823BE148027 7DF44DBED4305FCD C6D1B703C9E6B0D7 6C5A886E90781185 30262A764E8F3036 F7077E637C0168AD DED12F1D18F97D3C A4A2B71F2675B099 7023218D281E5690 1806CED07FC6F4AB 091821E3C45C6771 D017D525380C5911 83199ADA4250D3BF 220FDE7711C24129 01D76C67B42C95C9 757A5117CC60F6E7 132A3F0784EA3490
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309190032 (name+title). Key = MD5(password) = 28eadf46f996f3e3e7be7a2d18824d79, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b9460c7a-599c-6851-88c2-31e7f9682539
  2 e5b5f365-743a-4476-b6f0-607d0930e01d
  3 b4a30f9c-7066-01f8-b2da-73081c3e208b
  4 586046b7-8cee-68b8-b032-677b0ab77e92
  5 505300e1-855d-7d36-98a4-47c10cf4997c
  6 64dd3a76-242b-8257-9dbb-2135ab6de887
  7 25255b43-224e-07de-8506-1f23692ab2f4
  8 6cf2c218-f6dc-52b2-99e8-3a602e1dd801
  9 20609d08-ca5c-24e7-a53c-7cb581f47ce5
 10 4e980410-2144-863e-a5c9-c633b8f1dcf4
 11 bf49b361-9cef-45f7-864e-b474f6109a2b
 12 729899d7-28dc-4bf4-a3a6-4b4ced829e98
 13 b35cada6-cc1b-31d1-a50d-c665f2816c9a
 14 c7a7e98d-acdb-1fed-81d1-e4dab4b3c4e8
 15 d6c2a20d-2b92-39f5-8e9e-e67c1658cfe7
 16 6dc9feee-9969-4ca6-bcc9-02c1c362c7f7

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6406780528443134. Exactly this sequence comes out of new Random(132).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 111 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs