A858DE45F56D9BC9 archive

201302110359 18aty5

explained decrypted filler

seed 694

Metadata

Post ID
18aty5
Title
201302110359 → 2013-02-11 03:59 on A858's clock
Posted (UTC)
2013-02-11 08:59:57
Timezone
UTC−5 · title 03:59 against posted 08:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302110359) = d18c6db9e756f3c9227e1190cc78bdde (name+title)
GUIDs
36
Filler GUID seed
new Random(694).Next(9) ✓ verified
Run
Run 41 (seed 1,681,282,046) (seed)
Draw
8 · predicted N = 36 ✓
Machine boot
2013-01-19 21:58–06:58 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2CDB9DF18E9D0859 B15E5CC089C83A0C F99D656879230101 EE9C5D7CA163857D E090DE222DBC18FC 829BEB507CD8BF24 FA439445BBBADE79 650C9613B820058B 6D1FADAFCCFED43B 10532DCFBBAA950F EDBD0AA4A18F8D72 9CC144EE95F0FFE9 D5B7AED18154DAF9 92EF1ECCEB85B819 8572BADFB15F1504 0E06C67798786E3C 4A0D16018564E48C 49C36BA499DBF3E8 27448AC1095BB547 E998193B662171F8 D03C735661C4F352 EA6695C23D5A8AAC B2D50A7BB0870C47 ACD596231A6DB42C 8A4DB7406D914512 7F86E12D9E96225F D5E627716011ECF0 4E487ADCE2F9F89C 3D9185D6A1AFF12A B9C458BD49778AD9 9AB7DEF02C0B4001 DD8B3F365C9FD5A9 C9A79842A4DCE209 FD2C66F4D8E711D6 3867FA872046DF08 2B0AD469F24627C5 D1843DC8522834F1 EF2AFA382B70B07A 2AC16D29496AAC02 287FB8C72CF651F1 0DED8A12CFC679E8 B7252D0CFD0E07B5 04ECE39BB4165878 C0F41E7C83AFC88F 3F646D5FF7D38248 94EF4FC44040CDCE D4C7F515BE69447B 0A55A624D354ACDD 4CBEE80DDB304933 BAEA6796AF30DFC5 C937BD439F72D8E4 D8472781B16D3D3C 6CF0C1846F165E17 7930968384C4A0CC D042FB2A9D4942FE 0D46CC81C016678F 9D201806043C686B 80CAEF69B9B90903 71D7E3FCA2A62D11 86CBE7F03E19CC47 E43F64026B187E23 A28E3230536F7222 23EEC2B59F24F15B C8AA22D855DE9231 68E76285C8172601 EE2B216F4B9E4D39 C3032FAAC337E533 9290EAFBC74F0C16 762F48DA81462106 B87FA39B04F0D379 63DB819BFE98F195 A0952104815F691B 6619B0D14D6371B6 8473AD07AEEAF0F2 B3C8A7C2B29C0E46 15B9D910E41CDB2C F577AEA27E4A9572 64067AC457C35920 1C8114CCD5D992EB AAFEF3387A4AFCE7 C4B2B7B7666511BD 02A4ACA8DEF382C2 0F8347B96DCBDD7F BFAC53168ABB56CE DA7355316FE50E15 319EE1A6BEAE7CDA 166DFE1C771C5578 8C11989DC88301DD 57BB7662590B1115 E418366847938B71 E66C5581D5EA46C1 8916553A7DA621E2 1BB6086D9A64C925 7E8792628C0F4A42 881B9F96514B94E0 6746474550D09FE7 8741AF907CF24579 FDA11400FBB73F3B 51EAEC9941938956 B75A3593AFB5986F 4A19D1067C55B3AF C659174A19B3F7A2 E51F29B259FD8BBC CFACC7E74FE0361F 41399F1C64ED1235 F8B737A6F8B48605 FE3A1515BBA98089 0E47C207A49F5825 385B20E1BC40580E 296395CDEBA0DC68 E0FE598C96B8C09F ED1C82F4BF7696E4 1F3FA1608E038EDD B8875B4C61413C4E BAEB475427E5A9FF 52DF2923DE0C108D E6AD3D765FF2D8F6 A85DD5542E83E5D5 660B35F27C7B8F90 AA85F11AFD77F898 74B3DD7E8D0DC5C7 43DAA4815843AEFC 358404328C6854F4 08B509956751773B B68B16258661F599 0C869ECA543412B7 1021A986DD796FF6 1F9182776291D9A8 4B4C987BF61A7D37 BA8ED08ABA6466CF 1B57C8D6F2BBAEE0 93FC935FAE5BA7EA BEDA3E9282F5473B 87408CCC8C0F1DFA 01467102EFD34411 7259A8C4991D5F33 574472DC8D79F038 EA9293A34F4FBD8B 04DDAE47B8EAD9C6 3B960886607D6C5C 8B2D1229D4900B54 9472D4BAE6859D68 C7CC889D0417AD6D 45B8DAA5F5011B6F 3DFE270A4D34F89C
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302110359 (name+title). Key = MD5(password) = d18c6db9e756f3c9227e1190cc78bdde, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 687d0871-9c1c-2be1-be1b-1619349b7e3e
  2 dbbb3a7f-e944-4c4a-bdef-ad5b455cd74d
  3 3fccb812-75cf-7896-a14d-a2b15a023529
  4 80c760b1-1933-6191-89fa-bd22f5c0ef9d
  5 f7594c0e-e765-460b-bbf4-e258c4c87c11
  6 c011d6a7-dca2-0104-b588-dcada4fdb9fd
  7 58ebf036-94c3-7c27-9c0f-d78874f8db94
  8 5817011a-4176-5004-b2bd-ca4ea625da55
  9 e00da6b1-93e4-7e07-8745-a050419480de
 10 69eb3c11-6950-1056-b2ca-50bb10dd9d8c
 11 315d4ff6-21d9-504e-a52a-2ce4dbb5bf1a
 12 18f9ed59-be97-2a57-afa8-fa5d4eebf771
 13 3d31fd75-ab09-6d20-b4a5-29ddc57d3205
 14 04f90464-c53f-4357-90c2-badde50a8fb1
 15 879eb6a7-5809-64f8-99cb-4f2ba392d06a
 16 946791e9-10a8-474b-9ab2-b11fe03f4af5
 17 0f69bf12-1168-57eb-8ada-78e08fa48b91
 18 7af82f11-8735-2e80-a76b-1682c2bb44d3
 19 7fbad040-caa8-4cef-8f81-f5aaafc42f39
 20 26faf312-7483-0465-aea0-cd9f64afc637
 21 3a75f3de-8c69-0c28-9c60-5d153f42e558
 22 49c70dec-eba5-13ad-afbc-662c38b6f0e8
 23 15779519-a2d6-2362-8ed3-f5c3e1b8f9f6
 24 140a7161-e85d-4979-a508-863e3616866d
 25 d286657d-cbb5-6698-a9f4-7a97ef2e43eb
 26 edb36ae1-95c7-8f83-ab31-12ad7c13cf9e
 27 e1a327b7-b5ca-5fa5-84fa-f70bea33531c
 28 8bad1c2c-b377-6811-85a9-d62aa4e8d209
 29 4ffa511f-6502-24a6-a650-96d66a36ac82
 30 8f83c2da-5829-05f1-a7ec-20f27f0d76f9
 31 a766415e-9820-35d5-bd30-7f7aef469662
 32 0058eb51-7ea5-2890-b663-09c256b06d9b
 33 ca7256ad-c4f7-3d99-b594-a085e1b1680a
 34 fbd32961-89eb-3d4f-9e65-e7e651de1480
 35 b5ec79c4-1c34-855f-aba1-ddc1445368da
 36 aa5c1626-688a-727c-803f-8500b729cdd2

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 247640757152646452400124685620323387. Exactly this sequence comes out of new Random(694).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 8 of Run 41 (seed 1,681,282,046): new Random(1681282046), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-01-19 21:58–06:58).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs