A858DE45F56D9BC9 archive

201309210032 1mtlv2

explained decrypted filler

seed 606

Metadata

Post ID
1mtlv2
Title
201309210032 → 2013-09-21 00:32 on A858's clock
Posted (UTC)
2013-09-21 04:32:55
Timezone
UTC−4 · title 00:32 against posted 04:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309210032) = 3d7d75162fe9c4e98b42d3edb8b42bf4 (name+title)
GUIDs
16
Filler GUID seed
new Random(606).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
119 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

057A977A12B2AF7C 5EA376830CCB4A51 02E9D35B14D29417 5313C9B263F18B72 040A2792460AD292 245512B623AB3E28 7DD292EB69F2E973 1A42CC5088EF24E8 0C3CEA14BB89517C 89720BF7DC61210B D0524E89A9E068B8 CCFCD72084E91589 14C3CB7C5C4CFA20 92BCCF368439FF42 250ADB66151AA959 D001E63A967090BF 530D2F8304754B74 75C39D75FF3A7000 440F08783E006191 E5AB00F7025D2617 BC17F14A8369CB0F 080DF2F669EAA90F E4947124ECF3EADD 0CAFC4CCC71ED31B F42CE7C05FE9892C 08EA6E9D77188FF1 365DAD05F0265E5B B25B3F7231832844 7197205F5A54157A C7851C9CF94EBB03 8D00D1FC0A6AF01D BEF9EA3C1DE758A8 E114E5C96AA6043A 8BF7DDBF599A5743 3B1158A9FF52AEF8 3902EB05993E573B 1DC600EDAC4EAA65 4F86C893A28BED65 3632E2D9B46EBD97 892BE009F68386C8 2A77C505F9A1D465 C75266E6B0A46889 ADB69987A540FA16 C2BD8FD493EC865E ABB5B459ECF2A4EC 75EBED21F9AD09B3 C28818585BC49C39 92C35CE92B1B129C CB84E335889D70C8 DEC7D22ECF07FF03 884CA2AB65A3588E 592B2E6976114FBD C06C4E553561A484 2BA2B596A1646CE2 6D74D358E93342DD B70E06056B90C3A8 7C13225EF1CD3C0A A7CFCAF209795E98 76456CBF218270F0 22EAB0FFFBCE4E1D 63C800BD26D2435D A1893B7C066E2EAC 1EFC69C79B24FA40 39E57D4E77F82F85 377BF59CCF174CDD
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309210032 (name+title). Key = MD5(password) = 3d7d75162fe9c4e98b42d3edb8b42bf4, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fe1c253a-b27f-2b25-ad41-e15fb579c855
  2 bd07f4ad-e24b-5bf7-b51c-08a283181893
  3 0d51555c-c954-3cea-8551-06f106386237
  4 4531122e-267b-8149-99c2-65a700db475b
  5 c7587485-2816-7e1d-b9b1-0cb891dc5f61
  6 0c2b202a-b87d-134c-8b87-cdc093a85347
  7 8cecff87-29da-35ed-88e4-6e87e1c9adaf
  8 29bf9711-7ab1-4a77-8824-8b5ce96eeefe
  9 fdaaf03a-d1a3-818f-94d6-570505e92cc8
 10 379d0922-00d9-6395-bc94-a1a6e7a69868
 11 958db386-1ce8-6f62-b6c7-d3f2a9d09a08
 12 230b2626-95e8-59ed-b775-8a51a2dad122
 13 8522d899-5820-2beb-890f-3bc6f2e6bac8
 14 70a00e3c-b115-66f4-87b4-e4501aef58f4
 15 dd1d424f-245f-1d51-8f60-cabca259f13c
 16 a35c154a-a203-43f2-9753-5fb087a6e89b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2538713486652614. Exactly this sequence comes out of new Random(606).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 119 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs