A858DE45F56D9BC9 archive

201309191232 1mpwki

explained decrypted filler

seed 594

Metadata

Post ID
1mpwki
Title
201309191232 → 2013-09-19 12:32 on A858's clock
Posted (UTC)
2013-09-19 16:32:56
Timezone
UTC−4 · title 12:32 against posted 16:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309191232) = 73d5dd9e2cc83a595e5d3dad27e9ba9f (name+title)
GUIDs
24
Filler GUID seed
new Random(594).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
113 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

24DF7D99DC2F4337 36FACBFC0FEEFDF9 E71AE9683E81BA7D 091EC5AFEB77D802 BEA30D8BEB183B08 F9C9C44E5D36E4E3 97086BC50A2E0C5C 0FA142EC5C7EEEA0 A6438157CAAFD998 3674CFE6D7E4570A F4FFAABDD3212050 91FCE9F330FFA59A FB2841117B9F75C2 4C60D1C0FDF36449 F201040A6B781E30 1F6B421F29D64AF2 6BDE9522AEC7A726 9144F361B6156664 2A937913A0327792 92A992247D2B40F7 DF88B43EE3D1B4B5 230EBFE6004F0FB7 903E3826B1F6CC30 6A69835C122B4491 9C23AB281DB96A6D F24BE8447DD7F7CC 10A6A67745A6B0DA 7728D99ECD7D08ED 2406C48C33088A7C 26786DF33A4303A2 57925B6199E0F76C EAF894C2B960A167 80E4D0ADD1897901 06D943EA447801A0 04B30D9973A81A89 7D4064B4750270CD 5E3C1F851C6F2CEC 44DBA82A865E1DC4 9E9CFC58369F5D28 3420CFDEC5CB4900 BE91D267724799EE 92DF9E14CAC2F83F E20627ADFDE9BA36 C56C99984EB107B6 F7722762C0B8F4F8 70E36EFB950E13C6 38730788C855664C 474EABB958A53544 2CBB0BC76A365A4D C89D7DD900BB98E4 24D89C4FDC464E5E 067104614E0A39CD 1322CF8EDD33B976 201DCC5D11F34CC2 648840B706E5FEBE 2B8FEF439E15FE96 038789CC1F55B6B6 931539A72D6401E0 6BF9C68E4247357A 841F451539E580DA FF2E5C4492F70203 8B8A2F7DA9E8EAC8 BDDA75566990EFD4 F1DDE633B3902ABE B8E1A5FC9F4EAF0A 92254661F48EF536 E894E6803DBC55B0 92224601CD0A4096 EE1D55B28E080B2D C6F32B58D70D6EC9 0348E7AB66D793EA 4CAA95755EBEB3FE CE9CAD75B72D411A 1AA0835447D79F9A 140AD3BBFDFA1E81 95E76477797EC00B A95A32D7E322A462 FCCC8C35418854E1 2863A45ABCD13E14 A3F0DDEBA3999AD2 57D81AAAFF84F3AC 605AF174F13CD36D 5F4998A4B8A75C02 92180D63B56163BF 5867140BCEAFBA8A 5B7C16792535AB43 88C5090EFD32C4BE 539843E2C9551E0B ED67A5FA2007DF2E F104FE7C3BFE40FC ADC00646E99DBC8F 14EE45AEB92B5561 1E51734EA8718A09 134D72DCB1EA7143 3653F862F9F8F596 BFC8201C0EADCDE8 4A6F251CC3B1F094
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309191232 (name+title). Key = MD5(password) = 73d5dd9e2cc83a595e5d3dad27e9ba9f, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 13dcccd0-ea52-0420-9a66-7b73b3e4159f
  2 fe7ddc01-0725-0235-9c07-4cb0b9ee303e
  3 186f5ccb-aed6-843f-b6a7-67c1d2c2e120
  4 1247e78f-a7bb-35a3-b277-8052f8156280
  5 9c3659cc-6ecc-3a0d-b464-504cf8467683
  6 4666b822-936f-58ce-9371-a723a8b58d98
  7 3e7a476b-1e77-03ff-969d-5c2533a30bf7
  8 5272f482-f9df-37e6-a513-348034c7e078
  9 680fc2c5-1908-438e-bac2-dc75f9fbdd1d
 10 c9362dc1-136c-2a12-818d-dd6381cdd50e
 11 74b363b4-ad00-8f73-9520-568bda945dc6
 12 46cb017d-9c32-169e-bfbe-7be04da82a41
 13 bf606e2d-ea1a-8daa-9be6-d15a792ec8bf
 14 305067d1-0166-41f9-83a4-99065096d8f1
 15 c0ab4355-f31d-6932-8a4e-a4d7967be493
 16 3e6e8662-86cb-85d0-afc2-d7edf2da7e2e
 17 6e69bc24-5414-53da-a804-73243a54abb3
 18 79767602-a4e7-22ca-9984-867477da846e
 19 9dd1bb3e-6d1f-6677-ae78-4087715f47ca
 20 a4e401de-859b-2df9-9cc9-27e9def09be3
 21 b6aade6d-34da-65ca-af14-4519eca41a57
 22 d2f0a813-8662-5477-82eb-f2f7134ad804
 23 d77c8f55-12df-3c34-9e00-fecd8cb05570
 24 6c618ecb-602f-414d-8816-d4cb46ad4955

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 008335034281846852626534. Exactly this sequence comes out of new Random(594).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 113 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs