A858DE45F56D9BC9 archive

201301122359 16h6ts

explained decrypted filler

seed 680

Metadata

Post ID
16h6ts
Title
201301122359 → 2013-01-12 23:59 on A858's clock
Posted (UTC)
2013-01-13 04:59:57
Timezone
UTC−5 · title 23:59 against posted 04:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,576 hex characters · 1,288 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
40
Filler GUID seed
new Random(680).Next(9) ✓ verified
Run
jan2013-A2 (short)
Draw
5 (assumed: numbered from the first post)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
11 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: namerun: short

From the post to its content

As posted (encrypted)

7A9626A6BB8AC812 45E654615818DBA3 3FF94BA403F97311 FB7120DD6F83F12F D5EDDA71F248E768 CB0F7677157EA23B 1519FC39861C9ED9 44436846C9B25C54 D8A8FF54191E47E5 9470A46956A9E10B 520E1139B4C065C8 7773A3437317F2B8 2EF93D3390B86B2F EFE7EC396CFC94A0 082644164FCB7AA9 AB4A8CD0FCC111E0 E75F56DBAFD83873 A6A76ADA1AB2C4F1 765E085044774191 9731B0914EA75713 C42B0F3C778BAB3D F1856261B74743E0 572D7D87B6317763 33B21D79A18CEFE5 B64B33280C9C4523 4131EA8A9D324071 7238CB4C5A382253 A3B0DFA4A292C084 1C66DB3D453DE7A5 9D9C8D0C6C0C8F13 2BFD6FBAA2A1383F C731569D5EEC1139 E5F5A6B0A4465D86 DD24644E3D1DF1C2 F81BB43C6D49B394 9A268FD49C7F43BF 5F793333D5036C73 325C47C941E0EE94 B748786D87911891 96F9BA5F4393D089 04EDC1FD3A15551F 60E73DA94B4BA34A 4784AA394C670740 D846FDA2777309EE 4CE0E9DF00179B6D C29D7FC0CD50AA83 8CECAD655D603ADC 4BA56F46CD13960C 011E889129C166F8 2D1E9855B5DFD994 6CDA7EE9E9FDD4F8 8927BFAB62733D97 0413BE68768840B7 E043E25B7678357C 0CA1872BB5D48E72 C6DCA442BA8FDF95 1A947BBDFEE74F48 1F3D7ADF9537451D 279B095C5663660A F83ABDE0C24A8AF1 E68836ED4599E7AD A90EBE55722E61B3 3340F20222CFB39E 8BEF166867C481C0 CB3EADAB15BA95BD 67CA58BA338ADC05 229AAE25AE28F557 30C2713FACB1785B F2A929012C551A84 40D2719694CD3297 A3A654AD80599CFF CBD0A11D598A2E2D 336BE0E7607D2238 0E990DEB1B5C1691 7082BC37247B7D95 F46CE1BBA26DA7FC F44BF37C7E6E12BE FE91671C826264E5 343C6DF536E9C10F 6FCD6B2E94BC3A8F 53CA50E1E4D80647 194CB09C4F03B1D6 CC64AB8B1C00D715 4489E41B366F28D4 55DE4BDE75A04D12 5E4CCFCDFE110B25 F8A9793C2E3B38ED 3D44DDDF013F5430 F0EFD1483C4560DB E238B65094DC348D 8F26C3F3A963A318 74D1C3AC2664DE2F 09B2B690FAC49C95 BE6647C6F5BE43C7 EC978AD83F677BFA 97A68E0E9F86BC79 EF4FC32538AF3784 71B93AF82670DFE1 711F8BD641C0EFD9 CA0B7E92D1D52922 9BC55202DF59AD54 AF8BE6587F628CC6 455E58D65FAFC420 A023C39875723B42 A1ACB7FF90EF0AA7 BB5A7264B4A397A4 1B82B51B384ADD59 66977DD5CDA9357F B40DDADD1875D489 B8928108F84A2B7D AC1F9BFF6DB413D6 D888446BA6C0E365 26F8BD47FED87F3D 9EAA3C0B5F455930 7B04FB421E647A70 9CECFB0F74AC1202 531D6BC0EB793F42 6F15CDB800FA7025 BEB6FA49D32AFB4E 3FFB04AA90F96A87 BD5BE55A6FF5BE11 74482209865482DE E69145E911272AFF EBB34D4F2B4E710E A237AECC888A9F2C 690A06838C060CB3 EEB386C97C610735 37CDFB347951EC3B E1B1E6C34DDD6563 726C56ECF70EE71F 68269C0ADA7B690F 58B64DAC71F89AC1 B9014F781D1B1A57 0D7680411E894378 DD444A80E331AFAD F4CC1E79325319BF 830892BFB0E24600 4AF1149D46765918 E999E4587D7B6D70 FCA6BF2D9559E82B 9D9F129AD492A3A9 0CC1C8F4A1AB1D13 8F78BC31991CD48F 53099ACF2C462D7B 13EB8FFD73A1B233 D3C8A50A4B65E434 A778D4E3E6162CB6 EE55FF26AECE7575 F8FE417190017E76 3F42A04B6DE175DC 951CA304FD049C74 5F55671CE84A7902 AC52F2C7CBAC7E56 D5052924185ACF45 9F49BDA45660A64E 69690356065897AF 56BD3CF1740EDA92 CF1AAF73EB373735 EF2586017F9C4BEF C6120CA709BA4628 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,576 hex characters = 1,288 bytes = 161 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 40 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ea60c74f-ff1b-8122-b031-cbece69c4f81
  2 13970385-eba3-3a23-90fd-9f52dd3e9ee2
  3 59375bd2-0feb-0997-85d9-c2d03983a2cf
  4 4482297c-5b11-624d-8daf-3a581815a604
  5 843fe3d9-b453-1c0f-af0b-0c834d7b92bd
  6 6d41d366-c492-79c2-9acf-5def9420b3e8
  7 1d6d08cb-5572-5090-9b1e-8c36b8f3dfeb
  8 c1d11d8e-911c-5381-8567-78340438d32d
  9 3e3c5950-f1d1-0e6f-9c46-270a09ac2a3e
 10 eb95af02-5ac2-06c2-a95f-761781df6388
 11 e3beb008-5ff7-2816-9133-4c0f79fd1d5d
 12 989eeba8-53d1-3cf6-91ac-c30b94734758
 13 95177ce2-f128-0a1a-879e-0da4de6e44af
 14 3c9731c7-c979-2e27-93ca-c3f1ba9c38aa
 15 ec1b4952-ec61-832d-893b-9e653dbb18f2
 16 210f37da-bcdd-6648-9000-076393ccd814
 17 39a94e33-377f-6e24-8d81-2bffdf62146c
 18 2c594630-5bd1-5c35-a83e-976d79031101
 19 65610df5-36a3-03b3-aa57-93db60139fb5
 20 c8842c2d-5aac-5516-a55c-a4ab6078298a
 21 405abd7e-a969-1b88-9697-4cf985a4c5fb
 22 2b6fa207-f3e7-63d9-8239-eead43a9854b
 23 de5f932a-7aa9-81a1-abd8-3bf7955695be
 24 a2db1c4e-a42e-5d5b-bf2c-cb430eeef22c
 25 d933d29a-5f86-344b-8800-9f2465c0ee8f
 26 b0f4ff56-3b73-897f-a785-852b026a5f2f
 27 8dbb968a-7e1f-5ea6-adbb-12a93fb99f84
 28 ffc548fd-6f1b-0346-a9d6-b5605afe2178
 29 3b9399c8-97c4-3d9d-964f-0a1f5e8afdd2
 30 cfd07a52-6cb6-647b-a6ee-c6a219da7953
 31 0f9596ca-92d4-2bdd-914c-59ffb941ae70
 32 dd891b9a-def6-5d45-b065-e6b12946f119
 33 0a6b4983-b081-6bdb-b285-a7219fd73578
 34 407551e9-6572-0a08-82f9-29d9b23888bb
 35 193a05da-5f57-0814-a24b-5a438e32dad3
 36 160a12dd-d2c0-2a2e-b393-7dbc180afca9
 37 fe98144c-d4d2-2771-999d-bdd4c3023f2d
 38 b77c3d0d-a73b-78a6-b14e-1dc00eca44dc
 39 0db8db26-5849-7f15-a815-7ab89cc04779
 40 f6bf9471-50a1-00ad-9cf8-7f4e09fbbab7

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8306175500230286650516853850362560022770. Exactly this sequence comes out of new Random(680).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in jan2013-A2: piece A (second instance from Jan 9, daily, zone -5), 7 posts at range 8: undecidable, all boot hypotheses chance-level
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs