A858DE45F56D9BC9 archive

201301102359 16d2fr

explained decrypted filler

seed 187

Metadata

Post ID
16d2fr
Title
201301102359 → 2013-01-10 23:59 on A858's clock
Posted (UTC)
2013-01-11 04:59:58
Timezone
UTC−5 · title 23:59 against posted 04:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,576 hex characters · 1,288 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
40
Filler GUID seed
new Random(187).Next(9) ✓ verified
Run
jan2013-A2 (short)
Draw
3 (assumed: numbered from the first post)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
11 · 3
Tags
automated (decryptable)2013Encrypted masked GUID listkey: namerun: short

From the post to its content

As posted (encrypted)

8F4F0720A57DC065 90A7B2269DA5BBB9 3542E54867C29125 A066A87B6A51A99D 4980339342107181 F1F0F2092776A44B 0C3C7EB2659E416A 1E11F522474CAB98 ECCA715DB321622E 1CF827BE6760C6D1 BC92A6DCAE6DB2D6 183A2C2A759B0193 042C4E6FD7DC8C1F 7CB863FE88B87D53 B1E1299347B36C8F C13590C128C52E62 94C63949107EAD50 0A356B760EC34AD3 F6645BF258B78648 1BD683A55E035150 2A55F6345A28357D DB90E9B6DBC84BA9 6354E67F475F5C6A 3116865731E9AF37 F310CD4C1D12DEC8 A94ECC13076786C5 EAA043CD8102543D 506ECC595DBFFB9F 5CFD3615390D80BA 4A081AE20367660A 6499DF6F013A361D 655C63686E81F85C 78F194FB532FC880 420B3AF16DBBFD3C 1004310428A87D4F E3E40A73F8C0158C 1C677C1995691BAB B346C78D84AFB5D5 BEA9406ED231FBD9 5070BD3E7EBDB180 B9542165AA7670F6 EE781C5FA135B56A 5E12FA25A63DAD14 A6E3035B9666E034 A5920E1F47419EFB 1225E951688B3201 115F3FA0FADC1239 AD6A241C7CB92214 6B091D7ECB4E6739 8F6C16B107BD96C5 8867F5FE74838DE1 F93759BDE6B478F0 2CCE2F2283E29E6E 7BB88AD73FEF0C94 6576218803033579 380B6B6CA6631C4F 26CF903D0A627424 A6D0BF54374D61A3 14C6C40531F78BF9 4CEDF31FB4F25211 CB1C74A7FCB5109A F2A29AC456A7EEF0 617028978200C4A7 856999348368FF53 934720D4572D15CD EB3705A6D691B816 1C980B609AFDA2CD B832684B69AC7641 3BC7086F8BB16403 9C6954AF5B7B2257 397854F9556E3A42 A72641188A24B324 08840088D95FF61B BC2DB53541F2A74C 4DCD7A277811F159 A549F6C9030747D5 76C000C1C876BB69 17516A28A3AAC6B7 608A32AB343DA79B FDC66A0FD335E1F3 C34535365D512363 5042DCDC7093BC37 E0DCC86D5E34A281 DAC96A54C5955F85 373BF04D2BE1B40C 52953F364275A5B0 C51DE9EBA7DD7FC2 CFA1056200C38AF6 C7B07F0E3B8E687F 2A5E46ED6773259E 6ACCD72B337E5FC9 424A80C2F596BB45 30D27EC74F51FACB 3355B9993ACF772E 62AB709C9039B9C3 684857C2A2ECC5BA B9E2617D6C15C3E6 B15CE3FB6DA8791A D214F51A1E3CF12D 581C9ECEB009525E 5D178FBBE810A28D 0BF570C664DD4E86 85AE77D683C25EAF 89C46D7FF23ECA22 AF6D53679A646A6B 8AB3F32CFEA85FA6 AE7D5EF6B185F5FA 7C1795CC33272BE1 67BEB75949D0FEA6 E23E32D568EB93F4 7278B4179B78D6C3 C2755087CC52C691 02893A34378D04C0 30596B37043EC6A0 656223727DB6E23C E96C4B89F4285A17 F3B3E1CFB975C24B 496C3EF10D2E2BE6 A5716B048120EBD1 58D19EFE4D7A4B26 648C0D0248BBF681 4B8DDA5770609068 D6B761F1DFC0C304 53F9125702D42AD7 79B9A29F5B935878 B83ED743406E5846 6E0CB1C3A8E662C7 D176FAB5C9BCBECA 7A853EEEC1B663AB 892EE7072A75D3CA 7D64629C9D176419 1DFE887E706E77C7 FAD32B8F06CA46A3 11BFA80EB8C86A05 F814C57860129202 9ECA0A9FA567081A C740FB6B3721D7B5 748446198FC58959 3A1BAFCD4C3015E3 574FB359B8BE5FFF 14374A287EF5C240 7A2021E153878FDD 10B326438C5D6E1D A182989E4C9D3D0F E85A063504757DFA 4A151697BACB2C45 E5026F1FEA6F9FF9 65480B4CCB8CB796 D2C55D81D2A3BE11 D05EA58ACC4CD376 2B21CD8A1D717E6E 153EA482007C03B0 A9C98B4D0F2DBDC1 085747177A41D240 2D1BDF9C1F28742B 85F22A2DC03BA1D6 523142C916F73757 2C6FAE0F96DA69D5 3B26EF0987B658D5 A85C67EBBE1C548D 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,576 hex characters = 1,288 bytes = 161 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 40 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ef89ee3f-f5bf-3304-abb4-43e579439ea5
  2 14b83129-b268-690e-a91f-54776b6767e7
  3 390eda8e-b77a-42fd-a9fa-5d3f074163d6
  4 bd3d7a49-4746-4b52-8474-21c3d942127e
  5 1a1f888f-9a30-51e4-a8b3-2b2382858b07
  6 fa7d4f17-fec3-88e6-bd74-fc3ca8d360f2
  7 32d0678b-7ffd-6dd0-a52f-5185f387c5b9
  8 b87aa18d-84b7-2825-91a1-edf98b5d06da
  9 39e6291c-9ede-15b8-a64b-a0a36f1f28c7
 10 134aa873-445e-2772-b739-81cf02a299d9
 11 955e5709-b412-08be-8909-cf3bca9741e5
 12 e2ba707f-7041-40e7-8377-a0c638112c3a
 13 1d8009e1-64c9-1720-96a7-ddf6d307a389
 14 8a914d0e-cd4f-6087-be14-310fa257c780
 15 792052f2-816a-7e96-b3bc-40ab65308886
 16 263c90c6-08ef-7b96-95d6-08bc1b9172aa
 17 83958908-fba9-456e-b08e-9c625c0b4c2d
 18 f0f3042b-9ba4-8125-a797-0dc0ecdea356
 19 a7734dc9-b855-6e43-abd0-35d81ae3d703
 20 445f0b8b-6f7b-6c87-86a0-e4b606dcb5c5
 21 6cde92b2-4bfb-5807-8b84-640df1bb3f4e
 22 0dfa3aa4-6e7c-6551-9108-db12b1f908be
 23 b8fd20d5-5787-55ca-89e1-b46f8fa9abb2
 24 88f4ea05-30b5-37f5-9e01-d33cc8c98ae0
 25 1823369a-a516-07d1-b9bb-371246e7ee6d
 26 78b3dd2d-4b69-77cf-9a35-10f2d78d39bf
 27 c0b7fba2-6f68-6d5f-ac2a-6222df926d86
 28 bab5fc27-122f-4c23-880e-f74889d6ee65
 29 ea1664ca-78e8-1b5f-bb05-19e0342a23a8
 30 a3d90c65-4f8c-633f-ba97-a392d7c45f4f
 31 e8879070-ab9e-2c64-bb1b-e3d224eccd95
 32 a253435b-5ddf-6df7-9f2f-0c512b129a35
 33 c087af3f-045e-41a0-adc2-49597ee5af7f
 34 4d3879a1-e25c-6e99-9107-400f96d6d9fd
 35 e92a98d3-68be-87cc-b80c-1950214ebcd5
 36 7e9efc3e-d56a-7559-8117-dd644dbaf53d
 37 527f3638-44d8-89c2-a9e7-288c10b4e47b
 38 78812495-5684-752f-8131-76c753248432
 39 e4a8cc72-ecfb-35e9-84ad-82e5a5c75d05
 40 70370d44-8912-1f2f-a072-bdb90191c708

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3644586212041677486656530764162646878731. Exactly this sequence comes out of new Random(187).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in jan2013-A2: piece A (second instance from Jan 9, daily, zone -5), 7 posts at range 8: undecidable, all boot hypotheses chance-level
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs