A858DE45F56D9BC9 archive

201302031659 17t3l0

explained decrypted filler

seed 847

Metadata

Post ID
17t3l0
Title
201302031659 → 2013-02-03 16:59 on A858's clock
Posted (UTC)
2013-02-03 14:59:48
Timezone
UTC+2 · title 16:59 against posted 14:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302031659) = 436cf4ed11885232482d39d9f51b5a85 (name+title)
GUIDs
36
Filler GUID seed
new Random(847).Next(9) ✓ verified
Run
Run 40 (seed 1,069,639,703) (seed)
Draw
13 · predicted N = 36 ✓
Machine boot
2013-01-09 05:52–05:52 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 2
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DCD9652A9642BF6E 98A151B313682128 23834486B9FBDC86 A0C0FD1128B94E05 C93639C9420D2579 801C2C0E3065950B 5832D4AF42820B9E CBD9E015518F8D1A C8BC9AFAC1E608AB A85DA537C5EDD5D1 863F052483722305 C858698A570237B8 AC5D5050E7244C38 068E28522808EE08 374DB7842AA7C5C3 A5FE32CDA984A43B 07FFE345A98F946B D7A4F37212778E2F 80018880AD85537E 1E700FCB758029ED 856911DF2BBD2F25 3D6DD42090688A0F B0C72BA5445CD447 15C69CB1E6295C71 1B139C9A89E66A27 D450B4F461F8B820 0C56D36D24743312 78771FE1C70B21E2 C9239BC4E79EB98B 83A3E37FA390A569 C8D309ABBF80335F BD9C2C2C87263027 1D1B3AC8BFF55C3B E50B57877441E26F 1A1F71AB6997F74C 642BE5153024A927 190E60D401857557 035D969E5A6A6910 22A396C34DACA175 E2EAADCAD36BC14D AFD0A0BED58F0EB2 A8F9C1562AF55EB3 10550CCC29FFC0CB 6D6ED65F567CCB82 639246BF4E3531EB 312BFCF4A840AF7A BC7B32E160AB6EF2 2827D23C48ACA206 46670D44CF66A654 3D30EC0594214F0B 601B3D23E78C8C76 F892AAB5FE6DB388 389EB1A22BD5EB89 52B4899F7D8DA361 EF329AB057326F2B C8303B6782AA4946 C4376051B01E66B5 F64E4057B766CD32 D2F5111CD865DFFD 0DFA156D8C1A1F2D B0FCE342B127F9C3 746A3EAA53FD39C5 9C2AA2C4CB91AB20 DC770BC152CF4B51 8B4D6A7D43FA3013 BBFB901575322D25 71163866B8B7952B C0D18650C999CA07 D5378219EAE9C9BF 8BBACB6C004C9D32 01F3C737843B7B76 E257DE8CE1ED48EB 8F86A39860610C64 26D8C8B147FB482D 17535D8EA52714DD 9177562A2351B957 B91E352E2501E1DF 48F9A997FA69ABC8 E85C7A4B27A0D89B C87D0509106EC244 D6419AAD3B36D5A6 69A866226D606C74 B34937A2413AC6BA C5909EEFC77D8DE1 4E6A429E461F44F9 D4531E73AF05991C 5FD37CA70B826322 90C3A31A7862951E 94273F885E90FF38 456B7D664A0E5409 69B628EB7760CDFB 36297B6C9E321C9D 65AAB5CBD5D19D91 D24B355006A06B69 7C47EAAB0A31CAE4 16A68F1C55DA2E24 3AC5CFDE555CA3A5 33EE722954C2653E 11E32CC2A3714981 EB4BEE3E1DADF536 89F241484AF8F9EB 68E68E22B6CC8610 F55AC2F8343B1417 559E63F4FC2B79FC 723962CEA4AF8A86 1E12FFB1293F1598 D6EA06C0959F71AE F59BBD20F1CBFDB9 60BA41F2B670C267 BC227760A394F2F1 21D71424AC6039C5 95CE3EA6E261017C 89AAE9882BC3A5CB 3531FEC87A0E0E49 5CDB41FEE46F2DC1 65A6F8F3F4C97859 F83138DE0A86CFCD FCBA9F9B3831A63E E681DC3FF972236B C1D4F9B5B4ED03EE 20DB20FC66A7B749 C88315C7C927F4DF 5DA59F888510107A B637CB4A2FA1BB89 F6DFDE7114310FDB 79AA29AAA5058DF0 D1A070642D30624B CCF17BF5BB366D58 79D2ED65437658DC 5C1E57AF0BCC3F45 62F39146436049FF F43BE1C5305928D2 94337F05697A0060 86A3ECF85A42200E 315D20ADA3642F10 88AD17F88192A129 42BF83DD765131D6 9816310A736BCBC8 4F02014AFDC44F1C 155C57D57E536A2E 68CDD65CF5881341 ED062260E4399A7C 998A785FA0E2CA52 309E037A53B1134A E9E3506296545F2F
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302031659 (name+title). Key = MD5(password) = 436cf4ed11885232482d39d9f51b5a85, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0958b92e-3371-110b-a0e3-0117cc7d7f1d
  2 768b9e8c-29b6-3aa5-a4eb-4e41387ba29b
  3 424ad287-5d2d-76eb-9580-18912b9eec94
  4 b3bf0e17-32d4-3377-ba8f-09ba50709cd6
  5 ce0aa9e4-7018-539c-b156-bc2d3eb7957a
  6 43f1db5f-8831-6c1f-9399-bd050b0cce57
  7 e4e3b0fc-a899-3009-bfb7-d29d9785a9cc
  8 9ab295aa-78b9-34f3-9a1f-23d49bcda8f8
  9 19a8e407-679e-63a4-9bcb-b92773a2870d
 10 569028a5-13b7-5d49-9565-b19931ff2a75
 11 9f046c08-baf0-2a16-a9b5-9dc5ba835e82
 12 efcdf5cb-65e9-68d3-9277-1232b5dad7cd
 13 e24dab9a-c678-864d-992d-8dd4830af743
 14 4235570d-27e2-1b1d-a9e6-e54a0cee3680
 15 edb311d0-ca18-755f-afea-4a19433e0a91
 16 4ef14205-e39d-802d-a4a5-0df211c007c5
 17 2143298c-e44f-8488-9a56-b66c44d94c62
 18 ba989b8a-3bf6-1658-ab5f-3695b7dee5d0
 19 d031d885-d3aa-5421-ad9a-7db2de57173c
 20 18d99fd9-da59-2c56-ba15-b12f47db177d
 21 a3156bde-fffd-3657-aeef-d608ab1b3872
 22 de6a8ce8-3483-5439-a367-e941cdd8f1bc
 23 76748b19-bf34-111b-a582-94020b3238a8
 24 e764f6f5-3952-866e-a27e-0c0354182f5c
 25 cb08b73f-80d9-626f-b544-48eb8a344760
 26 64226a7f-49a3-2604-8061-ba258ebf0c0d
 27 571f997a-7e0f-1e80-9331-56a7a33c8b30
 28 c3bd2119-af9b-4c93-9eac-12d90e509e39
 29 ceead714-4034-4690-b57e-747c62ef1d39
 30 fe94b8fb-a70f-1d25-aa92-ed7bacc6f96e
 31 12e3626f-112e-749b-a312-f7eeb1a1e831
 32 fe1a7d8f-4d89-5f7e-bbf6-1691c15a1ed0
 33 31b1dc27-a504-8540-aff4-ffd29224e2f5
 34 05570912-659a-2bdc-a48c-558308af339d
 35 9c26fa6d-3725-3c22-9627-6e5cccccadc6
 36 2f98a493-181a-4e0e-b010-f5e080b6f00b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 137356336526817881523518621441758234. Exactly this sequence comes out of new Random(847).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 13 of Run 40 (seed 1,069,639,703): new Random(1069639703), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-01-09 05:52–05:52).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs