A858DE45F56D9BC9 archive

201302100959 188xma

explained decrypted filler

seed 670

Metadata

Post ID
188xma
Title
201302100959 → 2013-02-10 09:59 on A858's clock
Posted (UTC)
2013-02-10 14:59:58
Timezone
UTC−5 · title 09:59 against posted 14:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302100959) = 21cd11c7d216368db784bdf7758237fc (name+title)
GUIDs
36
Filler GUID seed
new Random(670).Next(9) ✓ verified
Run
Run 41 (seed 1,681,282,046) (seed)
Draw
6 · predicted N = 36 ✓
Machine boot
2013-01-19 21:58–06:58 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

73ECD4908070A45A 857B15CD8477BC92 FF82B6C30D22974D E9DFD74A27D2373D 39A9D927393C9437 D059DAF43AB2839E 0F217EC1C467134D 60D5632619774629 0C26C278151CBFB8 E0C708995FDF2E06 5CF3A1FA84E88B45 ECB199914BA70049 C849299133FE1825 F85C291519E43ABA AD1A1558A10939B9 4FBFDCD4CB69822D DA3AE4CCE0D212EA EA907D86C065DB0A EF808121C6658E03 9E350A945621BF37 F5986DB37AFA19F7 9FDDD551F5ED2DDB 3EB31D401422EAAD 5F9350C6C3BB8F9E 7C9A38EE709E1D7A CCCFBD376730C4BE 85D065B1C7C17497 6CAE2823572AF995 DE852439D65C964F 881B7DF4116C483A DD362095FACA8A74 12E55441B5FC67F5 ADE2ECE0975FEFBB E16155D6D1D35E23 0D0F2BDC9493CF79 754F3A2EF1CDC897 CC23995217EF4913 84AD99371C0EE956 9196B3FBFAD4E956 37A02C1412050E6F F3663D301C3D91EE 829F47B8DE2B958B 2A853952B9B9DE8A 1F2E7B5ECEDA6BC2 2C82DFC66783E9DF E2318CD9AE5F72A1 EE9D946067645EE2 5843F5068393B412 C73295DCE69FA5F3 D5B152478A12F473 4A4CBF1E1523BAE0 99B86636D42DB512 0CD3D04565BC0E89 B4CF7748F612C408 8DD15CFD8C9B00B7 15CE4338FF0D742A 6F3AB5998C392CFE 112EEF21E580BC92 376571F06BE60837 6151C5BDF9A5D9A6 248E0D5834BB1096 6E59E76960F17F6B BE794BD2B4293B8C 9503D5BF3586C3A0 F15A617D26DC8818 D636EF88F9AFF9DC 9A4DE798885BA314 18C2CDF33BBDFEDA 7F80517B518DD78D 59739B43ED9B6F95 1BEF801B32D1F3FF AC936D3A843703D8 9AFB4F7B44E83608 0A9D0F09DCBDFB0D C51DA8298C30BB6C 0F4EC1BDCDB2E4EB D9E0E15B6142E785 379F00B3B8B525CA B62D03A82C98E114 C5CE5B2D955B53A9 68F57F15CDF430EF AF200DC1FEB18132 2954AA7DEA06943E AE95581D542B73B0 CDBAA3B4EA976097 33C9A32E694D0BFB 94A6E7183D7C9BD4 125BEA77E54D3C97 1544B3B808DCB76E 980E5988083BE15B 8AEB7BEE1E461170 BD33E54C576B3477 2217AEA081322C4F 4559997294CDF0DB C49DFCB0C5FE0B89 1B27528509EE18B1 E34661F5E259AECA 313CD226BF248DCC A40EE611BBFAAED9 17B0E7226434F08E 428A438AE77BD3A8 8B26AAF06752E742 9B1797E17C61AE5C 0C0474BC319EC397 094BC09BDAB0C115 3F3540F054F66E86 10D800A697A28E5C FE719EE45FA9B1DD FB26B6CBF170D120 E137B4425C79804C 1CC082520F6F2D33 AF1DEB603EEECF55 4480C63F3EF8FBDD 838B8D9AABEDBD2B EFE3FBB8ACB3DEE5 2E41C6C076D56DBA D5948CCA666F9111 E40AF26F51114951 9A94A4CBCFEB3B7E 83FF70994567857E BE5285DD69ACFADA 74E5A3143D63A060 6C970E186A2035AE B3596DEEB728CEAA B7C64CEC6693A7D2 3B7F29753E24B98C 464E59FB234328E5 1ADDE49FBC19CECD 46DF983589B642E6 D37616F145958AED 1CDA3BF45C98474B F2F020F0C6592977 F812F50B280F9135 2CAA9FAAA02F3AF5 9AC14502E590B323 113A3BAC3933B66C 9816DEA0A978260E 0E50A21C17EE20C9 39899DC79883BBF0 4CB94932263B033C 8C6FA6BF948C94E0 E411D897F776E92D DC32170DDC4817CB 73E1F2AC91419D2B B01349AB656EFC5B
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302100959 (name+title). Key = MD5(password) = 21cd11c7d216368db784bdf7758237fc, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5bbae5de-6af6-6e2e-a296-dd275ef4a571
  2 fd7dcd11-f030-3487-a538-0f8fc061bdd8
  3 51e0b682-6b1f-084f-a643-6adf94424f4c
  4 8d824bc3-bbd0-56bd-969b-341489fae2df
  5 5e205fc0-5401-6663-b4d2-7fcbe2428202
  6 1b398e9e-998c-0626-b5ea-fd5a9bf22157
  7 55f77200-33d4-04d8-a106-df740d951212
  8 fa2b9de3-62d5-5660-8787-5a33bb5a4c55
  9 fc2418cb-9153-7457-b0fa-f9a9c3ed8ab1
 10 f5be196e-2d8d-3b70-9109-54df1672c2f7
 11 a64ce1e3-651d-84d5-8813-d7dad1eaef6a
 12 5f9471dd-9b80-4b37-b4e2-13b33c2432bb
 13 7e3c0ddc-d54c-2a2d-8969-f86cdbd70b0b
 14 76d4ec1e-3b44-0ee4-a0c6-16263eb22289
 15 14f2ba41-58cb-8860-a48c-9b153cf38546
 16 ae572c4f-8eef-46d6-9c27-d81e494054aa
 17 9e27c9be-8469-412e-aad0-056062ef190e
 18 b28fa55b-4b83-371d-bad9-f64d40f77668
 19 4f032e2e-949c-7f86-ab02-f5c70a31eeca
 20 067b9e6e-d6ea-67d5-8219-0fbd8b1e8798
 21 3230685d-3da5-77c2-a5eb-298a402f0a20
 22 a769d8c7-08d6-249b-a8f4-45790ee1c4fd
 23 de88e3d9-d248-2951-9efc-2d654fc51c64
 24 907c4345-d709-05e0-ab2d-5b3ee20f6457
 25 96869a3e-8ecb-3d67-9be2-c5d19b1b6262
 26 127d9927-3024-401b-b6db-3536fd3cc8f6
 27 b208b50b-0386-876b-8896-ddad7a7b0e8e
 28 4a033be6-c1e9-7ea6-bbb4-f7137401a583
 29 7a9af764-32dc-5c94-ac15-156018d70123
 30 db0fe152-c856-6314-8a8d-2429c30866df
 31 88609f99-f07f-4054-a7d7-c94ee239fd5c
 32 71919a17-484b-8387-b950-287a962cf687
 33 1a98638d-0987-68fd-95a7-e180afc6cb79
 34 6b73ebf2-c111-7704-84e5-1bb06698afc6
 35 1fbce6ca-0d1d-5786-b7cf-12a6f19cccff
 36 b10bda2b-550b-7e9c-a2e0-6f92045399a2

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 630560057384208443767220348756486757. Exactly this sequence comes out of new Random(670).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 6 of Run 41 (seed 1,681,282,046): new Random(1681282046), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-01-19 21:58–06:58).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs