A858DE45F56D9BC9 archive

201302111259 18bj4c

explained decrypted filler

seed 165

Metadata

Post ID
18bj4c
Title
201302111259 → 2013-02-11 12:59 on A858's clock
Posted (UTC)
2013-02-11 17:59:56
Timezone
UTC−5 · title 12:59 against posted 17:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302111259) = 86b80f8cdb7bdfab54034377e2a97eee (name+title)
GUIDs
36
Filler GUID seed
new Random(165).Next(9) ✓ verified
Run
Run 41 (seed 1,681,282,046) (seed)
Draw
9 · predicted N = 36 ✓
Machine boot
2013-01-19 21:58–06:58 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

01B1ED9851496B79 D1BE74C9DA2DE2CC 6FB4AC35B429C5F1 98351FAF2107CD93 95913303B8FF1C95 102CAB6EB7635C4F C46385A7866DE069 BD808BE22DBBB676 339966C6ADEC8029 68D18DBEACB5290C D7541FC2E75C8AB0 4F2FBE746B9AC451 5695A4339C0BA345 A189F56524E4490D CBB6502D4D88ECB3 C9070F23A877BA93 1540785EA1F3199F 071D200241C8E514 329E75C9EAA0CD56 9F2C0E62AB0D2C3E 0284E2400074E314 E2BCB3BB5A0C6482 0781F931839F392A 4994B2453E34C90B A745D455E32E6556 F84E9BB46849A2F9 DE1EE1AF1451F516 76999F3E04D086AE F5DEEC09D37F128B 5804F7682F84335D 6AE04E3BBE577338 CF7FB13752DF8EDE 0C797E5082572178 C3815FC293C78813 A78E64DDD5BF4C7A F63B0029AE9ADC5C DD0C40885D5B2BD5 228C58401B949960 6189561CFA767EEE 689744C11A17BD91 E767C44E7255E573 35830F3628C50DEC 97A7222EE3A619A5 B84C38ED9624933B 7F30664D22107872 7590C78F7F99D486 40480EFAA70F8267 B32AFFC9A12D3530 297DA4E788803673 ACCD0C1FA58D76C1 6285E22803E57FE4 D20A824D74E2E206 F51699312A5CAE80 2525BEA884D24029 527F3FDC59F1C84B 58B62C2ED68A0FAB 491E4732DF15F63C 0ACCF5E1AE3F495C 86B472EB09937E4E 91FB1B8CA2217A6B 145667B6CEC8D12B 13378F7D62638841 F0F083D73E5DADDF A4C7C606068A7C4F 32406481FB28B9AC 9B98FA6EF37BD813 3EFDEC3F203B8332 EEF00BF2061A47F6 0EA9260B93961FBB 825B39E4320F290E 868B6134894CD5CB D12F193512F07538 D4F5344E754DF4AB 8428A686DC62F90A E640860E1D5BEA1D D05BF788D0653212 7BF47576F39B69AA 6529EE4A403BB5D3 A44DCBBB98A93F4F BC8BF8D8A475306C 8CB626BBCD983F29 743765235961E177 17406A4754E629F8 78B3C5AA6967AB37 81C25A3F099C98F3 8981951C0F1A1990 5E048EF92F5D49AC 97411494238C2BC2 2C617ECF0A605D3F 6A00F7869FE0E943 AFE994A081FE364C 6B4C78D1631A7987 19BC7282986AF423 B671C61DC7FAD26A CC24914595997B2D 97155DCCD170B323 494C3112F86D877A CCCED93C38D42327 E23BC1EC3D2CF801 2B713056E5AF3291 C4A7D88A13529109 3A5B6E856AAEC9FB B8FB8777161C6FFF 6946D8B30474615F 4713AB2125225659 4B204A76ED476BC2 AC43AEF33A6048FF 0117D2842E28995D 1C5D6A4351469C68 BF879A6DFD50C5AB D87CF6793998564F C3C07101C10C7186 16962F28E814BF0A 0138DABA456833F0 E12AB7D35B5EE95A 3F24715102B497B1 18FBE66E6AB59564 48D520CF51E4AE6D 25F6374838B33839 A864B142FD01C88F 33CB9B97ED9CC8E0 14A434B843AA24FC 1E70D91312F6C643 7EF240A288931297 5DCA16653552D508 A9523B3FAD427C7A 3320D27BDA1E5517 38B62A6B0CB732A0 4AE21DA90BFA7D0D AC37A5393E653796 B5796080CDA7C418 D06AE5298E31102B D4CE64649F8F7BC5 2034C1D9CEFDB43E F3B6BC2F0BA72475 78D272E273DEF32D 4EFE06718C2A2AC0 B309BE83F6ED9DFA 77BEBB22CE7B8C8E BB6038E0C41C9709 167B44513A674DAA 9A1F0D4CF8052F9C 9CF99E7110B6E559 FCF7D735129767E6 9AF73AAF06AEDCE4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302111259 (name+title). Key = MD5(password) = 86b80f8cdb7bdfab54034377e2a97eee, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fe8aea25-9dd5-8c89-9e5d-087dfc32a519
  2 91c80299-d73d-2baa-8d22-f4f4c112c803
  3 0b263828-03e7-0215-bd30-2a821d3e5051
  4 4628bf5b-0c48-61f7-9394-fb100b677c2d
  5 14f21a20-ac1e-67b4-8098-5af35db9d677
  6 6bd0e05e-8ecc-6f30-85a5-c25835b71bdc
  7 e735251f-2dd4-7057-a443-babed45b84d5
  8 63e458f9-fca4-13d0-91de-0d9d60e7786b
  9 3636e940-a347-3e8c-8419-3c83e99434af
 10 091c6ce9-6dd0-12fb-ab73-4d36621a6e00
 11 3b5bb125-eacd-7d97-b28b-4552276b0797
 12 413492c4-fc35-260f-829a-08c75cb1d68c
 13 aa943b97-a91d-005b-a54a-c57faa0b29f0
 14 a5e99ee5-71a1-203d-8091-ad3b51ef7a3f
 15 0d04621e-2726-4cab-b9cc-5b9adb08a026
 16 a6abf494-76ad-061b-846b-306718f312fe
 17 76d5aed0-1827-1380-b6a4-52cac6009636
 18 aca4a80a-3646-2e8e-a441-a6e8a7d24966
 19 51c5afc6-510e-10a9-8917-3f94c9fc87ca
 20 02b8f80a-d601-16b2-8f56-4d528f008eac
 21 a2d47e93-1a50-6514-b1c9-eebc445b2b15
 22 882db70d-6754-2d43-8751-d4899582fe9d
 23 54cacd5d-9c90-7139-848e-41d6ad857585
 24 a259c857-b750-6709-9e85-3d490de770fd
 25 d64a7bbc-0c21-7891-8d0c-b0fba4ce2d3a
 26 adee0af7-c737-58d3-a72b-30a3f16ad07a
 27 ab431bad-ff7a-7b79-b62b-b5f0c724b12a
 28 76e6611c-c5ec-8d1e-9fb2-c6dd197f51c9
 29 495f6b43-b4ac-15f3-b0ef-5718be4972c1
 30 177fd8c9-8b54-8ca7-ae51-40790ce7c253
 31 2558f550-7585-058f-95bb-f5e1f80544c3
 32 8f46582b-a909-8413-8bdb-8453d414bd3a
 33 cda7b449-f6ab-5804-8311-dc8e2c184637
 34 81560fd9-5490-1e5a-9d2e-f43213c396fc
 35 dd7a7b3f-b25a-27aa-b704-639f3fe68f40
 36 9ce0c275-3921-8312-a737-4319c6c12bc3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 820666713172024012116276757818085128. Exactly this sequence comes out of new Random(165).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 9 of Run 41 (seed 1,681,282,046): new Random(1681282046), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-01-19 21:58–06:58).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs