A858DE45F56D9BC9 archive

201302130059 18fiul

explained decrypted filler

seed 348

Metadata

Post ID
18fiul
Title
201302130059 → 2013-02-13 00:59 on A858's clock
Posted (UTC)
2013-02-13 05:59:54
Timezone
UTC−5 · title 00:59 against posted 05:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302130059) = 68dd651ad6b70460fabe87300c54f5b9 (name+title)
GUIDs
32
Filler GUID seed
new Random(348).Next(9) ✓ verified
Run
Run 41 (seed 1,681,282,046) (seed)
Draw
13 · predicted N = 32 ✓
Machine boot
2013-01-19 21:58–06:58 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1B1240E00E13CF78 F80F39AC5B42B8F9 03EC034C5B955168 B53007F7AA7AE9B5 199BBAF7F58C9A36 A29DCA62791C2337 ABED33A12D7A67CD AAC9F63519CB457B E59D3FFACDAB9E5C A596C10264D12A86 12E172ABA4E5DD22 EE52E34A5C98E38F F56D3858DEA180C2 D2CA085FA8B1E39B 1DDF45570CEF78B8 372EEC75FDB9C42A 3D92541B3EE9C6B9 C435A1C7489CCEE9 97A00AD7F33CD2CE 735664F34A625994 B6C9EF80F95950FD 98F9669D7C357023 53289C907E9E0ADF F01E53ED7146201F 497CE01E317D848A F78FF6C534CB9549 0DB1D469D3720328 396F83C31342BF68 AB2E5FD7980A0797 27D66C1003FE74BE CB1AE2C3A771837B 00F6B98CB2ECC7FC C2FC40675BDB2810 9E851E76A0BB9D1D 46AB49B5A0D726FF 6B6A596E166FF6C3 6DD35E5874864A72 C6C41FF576AE2991 2CBC4953487A05AE 51C221CA0B21F448 6951A9AE2C8C96F6 94A226ED2C395DC2 998025ADD872C01E 33EB42F341DCD437 040D131595A7D190 A0FEC8D9CBEA6D42 35CFB150C0FEE276 3F77A1233098DBBB 3505BA556A17E317 E04A02F4CDE621B3 282C3F46AAC1A2CB 7776CC2D3AE7515A 751E4373C0805DF5 F164900708801B0E 18C78A23052F29AD 4EDEDD99AD0CB8B3 475CCCC83B7886EC AB1413A8925BB757 EBF0C84744845C23 D6E5D6E488846388 75197C2C87E3DB24 E4F8F7F6B5FC13FF 6FB4A3AD18C4E23A 7DC798330A6C6814 3372167288E5A052 0C2F4D8F651F5664 2390DD94AF32F031 FA49EC8D02195605 C83F4FA5B221D8E8 D182646631F7FE07 F926B8CD22EBF4F7 CF19DF211710EFDF D166BE55C3DCE441 4848FE073883AA4B 5848BB1CADDDE8C3 69022DBE8A4D0EB6 0B7D7331001DB561 AAD1E1649649AE81 82D6C4B0B025D78D CE2DF756348A30A3 6338D9C6FE143C6C 293E90174F2A7011 B77BD1BD0C1A6A27 6810237E528A5D3A 69208D5AA05472C7 0B628433A0BDB127 7643EA9E2BF22276 C3ADAC2E0B2C5802 410B1B391705DDC3 B31447D77BA6719B 2BB574A8F0159E61 B228ECBFABF13D16 E2DADDE1E3AAD9D2 8FF5767ECBA81679 08745ACDDF6BD1F2 4E22DC208AC4CE25 934F8EBAFE01F623 92681CC53751C78F E0C4A59FED4FD7CF 615BC882D2F05F92 83322872DF0E2E6C 824D58AE73E8FA01 821A3CD647ACC135 06DC98ACAA9527DF A1966ABB2527A953 6B1E30B131D0BC95 B18F6B42C8BF79D9 5B957A08E3F4F3F6 597D04498B8732CF DBCE3F4ED9B56953 C2E4D9D75F787D03 D31128CEE75E3976 EE1055056C4A4CFD 7457E73398BD9AE0 2EADE3DD57BC7BB7 0D760A95674231D5 ED32846F8141B7CD DB1D68E09EE8239A 2704FD65FACA5AE2 47B09710189BB0BB 9BDAC636F8F824B3 554927812D2653A4 4622FB9D700AE269 C768A8F236BFEF26 22472BAE015091FF 796178E776288C4A 0D4DF73883FBD564 61B3F354A4771A23 54C0270E1DF74891
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302130059 (name+title). Key = MD5(password) = 68dd651ad6b70460fabe87300c54f5b9, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7b3cde79-3680-4779-b890-b84f9ccc59c8
  2 92cb65b7-0a94-8459-bc26-baf60e738d93
  3 6c2fe764-b18d-0e30-ada1-4bd59fe703a2
  4 12b78290-853b-72ef-8f28-34d173e9d569
  5 eaeced89-3b29-2a80-bf02-50f3769838cc
  6 78a57a8b-cad4-621d-a11e-3e8a34ea0b3b
  7 42ce349c-ede7-7986-bb37-dbd0b3ccbe68
  8 f6d2162b-c3a3-0353-a6aa-91e69ff74d1e
  9 12386e36-57cf-0efe-8223-c5ee68c20aa8
 10 4c63ccbf-94c3-5f9a-aa56-fbb12bc58663
 11 76e3d232-1f48-643a-aa23-edea3f6556ec
 12 8fff6b57-7613-1f39-ae72-8635be3fde29
 13 38482c49-a63e-78a2-89a7-084b10a278e9
 14 cc8dc2e5-fc6d-456d-9312-513c43c8fda1
 15 2b7e7691-a76b-5baf-84a0-63b8111e0903
 16 018fcc01-ea32-3d1a-a0a9-9e18b7e67735
 17 13e656ad-021f-18cc-8d80-972620fcd008
 18 03231fd3-7be1-68d5-96d6-9a8986ee7dfe
 19 973c5a6d-1916-0c41-b6cb-6e75e340975b
 20 8f7b79ca-5324-0485-b27a-59fc7a425731
 21 c14c6572-1f9c-0db6-bbfd-d155965fdf44
 22 03bff262-4073-201a-90dd-94a75f85f1c7
 23 89c58d58-d173-754c-a3de-497522cc7705
 24 3c48bf30-5428-586e-a3a8-02f47f2007ba
 25 5e48627f-42b3-7955-837a-28863f6bee18
 26 8577b6a9-5047-35dd-9990-73c52fef28e2
 27 836850b3-5354-1ffe-9295-062153c5b1d9
 28 d9e82430-deeb-2f65-86ad-a9d72163397f
 29 0a8c502f-f0c3-6780-8efe-12143bbcce50
 30 b11cf931-c450-3608-b629-51a615fe6a41
 31 c4dd2362-a430-5545-8b3a-5998e60bdca9
 32 879246c0-0695-184f-9aff-a6fa2bae3614

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 48072670056174531600027573126351. Exactly this sequence comes out of new Random(348).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 13 of Run 41 (seed 1,681,282,046): new Random(1681282046), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-01-19 21:58–06:58).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs