A858DE45F56D9BC9 archive

201309231915 1mzrje

explained decrypted filler

seed 30

Metadata

Post ID
1mzrje
Title
201309231915 → 2013-09-23 19:15 on A858's clock
Posted (UTC)
2013-09-23 23:15:00
Timezone
UTC−4 · title 19:15 against posted 23:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309231915) = 7063a45c1dfab60f2e413bca4bf06707 (name+title)
GUIDs
16
Filler GUID seed
new Random(30).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
132 · predicted N = 16 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8677BA60DC821583 0A563CBC18163B52 0CD5276FD1C75EA7 5022DC05EB775E7E 6900AD8E59E2A3CE 71E62476B64288AC 852A17483F2DB782 A5D4041A67053446 1F3C2CCEF37D0603 B3A9817FFE751DCA E73AEE9DE8FBCE53 58C8AE7A8C408743 36AB68A7C8CB3C2C 8C51ADFEB7C48B5E 607E64899B52B4B9 402B2E5503AE6E38 C3201B35CA0F760B 8B2B778E2221D6E6 615532854BAACECC 2707A0091B23030C 347E3751654A9637 F8B4AF07EB4FFDA5 5B5431C9DDEE7D29 018BDD99916A7EB9 FB6C97E3E39A0BA3 D14259D2CE6E6AA6 2EE404BDEFB90152 F97DF4FCE442729C 8ADFDD197F39EF8E 56754BC9089009E8 9281B7854D277DAB BAF430535E25DB4C B20E593588552F91 3913798C6A3DF165 F5623C8C393F8108 EAD12D5801A0D9BA E8328BC9C6CEBAE2 C9AA886B8C15F8A9 F0ADF7D6FE862280 F03A1A11D9E43553 04EF51A21B28BAC7 5BF4EF2B8FDFD28C 876AF25CDFD70917 63A6ABBF12C8C619 5145EDDD57BEA49D 46CC5ACF48A2E395 9B36AD3515EB5B9C 04FB593263C59F5B 919C2AB88CCB69A1 AF93387D540F1CCB E11BFBB1CB3AB9BA AED2C92EEE8C963B 9783C20245CE1CD1 E3F22006963BFDA2 C0EA0E6AD315438F EC9FDD6D068003DE CEB5652918037165 3A28AB99DC6324F6 8E60E94A2B96D882 24250CF92A88E02A F4AB5A2C32251D7F D56CD7734D8FF44B 48B4276FC711561F 246A7A5A9907E928 800EFCB0601D2D6F
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309231915 (name+title). Key = MD5(password) = 7063a45c1dfab60f2e413bca4bf06707, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 22a4d150-d3ee-372c-a7d2-8ef53e238701
  2 07c034b0-584b-50f1-9d2c-e74a2d2dab4b
  3 3acd4fdb-d932-60e3-a951-93240330d5bc
  4 f34a0b95-6c75-87a2-88ab-c3c40c8840f6
  5 3cfc56f4-6840-687e-984d-f7e8ef3dc0db
  6 1e8b6c36-2f43-6a64-9e44-43eb5d44145c
  7 e9e73c0c-8010-3576-a88b-ed8a7845735a
  8 d4030423-bb79-4195-9460-6cd88effeabf
  9 52a3fae2-a673-6a9d-9007-40f083849751
 10 cc306c8f-caed-34e9-9d60-33eda0c2dedb
 11 602f2e88-24fa-33aa-8d8f-64fcdd90c164
 12 3515302e-f8fb-7ad8-b69d-11479302e726
 13 0f6b2d94-6eba-2c8b-88b1-5f4e85f83dcb
 14 41243cd1-4f8e-08f6-baa0-0a9cd648d44b
 15 a1cdef8b-414d-8536-8e59-72435308e9da
 16 ded6dcbc-8409-6770-846d-3466498bdfb5

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3568663463372086. Exactly this sequence comes out of new Random(30).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 132 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs