A858DE45F56D9BC9 archive

201309301914 1nh0y3

explained decrypted filler

seed 414

Metadata

Post ID
1nh0y3
Title
201309301914 → 2013-09-30 19:14 on A858's clock
Posted (UTC)
2013-09-30 23:14:54
Timezone
UTC−4 · title 19:14 against posted 23:14 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309301914) = dc4249a05d8a13154a373dc0694283ca (name+title)
GUIDs
24
Filler GUID seed
new Random(414).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
146 · predicted N = 24 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

888CC74555ADD764 FE779FCA6197594F 2397E272B8C3387B 705DE82F2884C3F8 F96B11C318532370 6A14DDBB519FE3CC 6838C1F5D5F9CEC5 5B33F5D8F28C9293 AD2414D12BAC3207 99E9663F2FE14389 2CBCEA1B2A5CEEBE 79FEEDCCDE1B62EF 3D04353F6B3FBB17 163CCDE5B445C1D9 AD8C552886931494 1E4C866CF2823F10 E81C16AEB2A04BB0 443AAD92EFF9BBC9 FEB2F35C6693231F 9C3F2CF7AADBD414 50FA88DF37894AC0 58A4A9FF81F54B22 56570C786B12437C 1C9294E345D2FD62 72EEEE01E483C7E1 18E23162E246AA65 657D72BDEB0BF001 877C688957D02AF8 840E2CBE514C76E0 8F8BEC698C543FF0 3D3FAAE5847F72DF 4B39C8A91D68EA8A 19C7F841A45220B0 11AFAC9DEB93D8AE 87A65B3906D5A92E 337781F337878607 25909990E345BE44 EAE1D2572ABEF0F3 E71EC513CA253B20 B45032D88477975B 50D733D7368536EA 6C303CA06B76E8BA 78E338CAEE149AA9 05401DD366267F2E AC39C6371C595225 1FF48C4A3E6F100F 338A4A0DACFBBB1A A9AF5C1C727D9767 5350E199C8BE6D11 652B2A61CD28E32F B4C335259658F3FC 75C3B36B5BCBD21E 176FADB4ACCAC8D9 AADCB38BC8CFBA1F 0353934A7CE459FE 4096477D1BF07653 54C83A8430403B1A 58A3DB0C52A570C0 011EB24663C9947D 8B93B6B727388F14 DCF28EA3B6D3BD5F 50CD565898BFA486 4C9FEDCD0EF4E627 923DF33154022827 3B0BD4F8A18FE5F8 82B24157A1A9EF0D CE8F7FE4359E22D8 AD01AC89EDC84C97 86FEB182529B59B1 EE97506A69257E00 426D510D9B10948A 2764F610FB6C2C43 EA956F0ED016B1B2 9D6B803211C44B80 7787432CFB040B46 D26ACA8FDC267A96 D5E2F85FC84AE396 469E1D44BA9E8687 A50105828353CE94 2704D184320FB09C 9DDE8E7F345E8C96 194C51ED8FDC7717 1533F058FC46DE01 33625A18EA3E4309 9FC582AB84EA028B 30263AC44570E84A C361581D3168E548 6CC28BA8A20283BE 6AE8933AE325BCDF ACAEA54D814C79DD 7A8DF8F1204738F7 7C2A26ECF6066E2E 2D926FEAAEB24C16 F0115719E7701D5B BFAC731132591E7D 27A376577F70576A FFE3AA34D8F6DC04
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309301914 (name+title). Key = MD5(password) = dc4249a05d8a13154a373dc0694283ca, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 98c33ad4-620e-0b09-bf5b-e5a466725998
  2 3a5d837f-7046-276a-aef6-e02276a43273
  3 0b6cdb67-4931-19bb-92de-891baf68d82d
  4 1678ef5c-7983-85d3-ad04-d84fcc76f978
  5 42021507-f339-18f5-9628-ad9e50beccfb
  6 9b19cbd3-5622-379a-b080-01dd32ed5ddd
  7 786ebe1c-552f-3de7-93ef-bb0980290806
  8 39584708-3062-17a0-81f2-5f247c94f456
  9 7f1e613c-efba-18db-a30a-3d18e962c70b
 10 32059b44-b810-8286-a709-70740b021cc7
 11 94cd9e62-ad20-2f0a-b8de-b492160e42ff
 12 4a27d573-8568-6da1-b452-b06624ee6777
 13 1c88dae3-1076-2291-a60f-9a49f7a5a85e
 14 29f0a0c0-54ea-7c9a-803e-fd87cc8e2d5d
 15 8279ebbe-53a2-6c07-9da3-11dd13916130
 16 7ad1d9dd-013f-5bc5-94d8-d1f2f7f333db
 17 95228443-4719-8488-9604-18f7c099b1db
 18 8dffeb03-6352-6ecd-a058-cfa41839c6a7
 19 a2f984e3-1085-7314-b000-c13c84bf1e78
 20 99f49269-1219-595f-aa34-3e4390774913
 21 34b16dc4-fa0d-75d7-bf41-ffea1afd0aee
 22 48c10674-ae26-3dfa-bdc9-cbfd57a9923a
 23 50f987b7-ebdd-81f0-8888-d891898f763d
 24 992d0a2b-b18a-5a81-a56c-5af874668910

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 021813311826276586757385. Exactly this sequence comes out of new Random(414).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 146 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs