A858DE45F56D9BC9 archive

201302201559 18wpsw

explained decrypted filler

seed 794

Metadata

Post ID
18wpsw
Title
201302201559 → 2013-02-20 15:59 on A858's clock
Posted (UTC)
2013-02-20 20:59:52
Timezone
UTC−5 · title 15:59 against posted 20:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302201559) = f9a867266abae5cf623f381bd5730579 (name+title)
GUIDs
36
Filler GUID seed
new Random(794).Next(9) ✓ verified
Run
Probable run 3 (seed 33,600,187) (probable)
Draw
8 · predicted N = 36 ✓
Machine boot
2013-02-13 10:24–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 2
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: probable

From the post to its content

As posted (encrypted)

BA0EFD6F645B0B87 703A7872CA4016CF 80DC6E8722FD57FF 39F3C16ED723029B CFB41B819EC6CE91 8F3018ECD6548943 AABF240773FD8E92 BD5A64610D05C65D 997F97457EEFCD20 20D94BFB16FE56F5 1712A51017CE19EC E4AEF462D81817E8 E38BAE4BBB63C81E 7B31591D2AF0093C A1E8A0741DC30BE8 BBC4CC45F6050BBD 8727E505D9C599AA F89A0767702B8943 D176A0A7BAA06E30 C7755A88D9F9AFB7 5A9DE15B2DF67B2A 174556969045A878 FB17727B21CA4640 13424BD2D65D931C 10B50917F4A00D8E 00F986A9654228A7 6B13DAEB2E50E2E3 718C0BE488CE6300 3AF09BC8421BADBC 988CC79E9FC83453 4134C0382468795F E3FF90CEDED6EA3F 89303C07669D8FBD 2DA63B3C2DEE259D 1DD1C65DB8884DC5 5EFEFED41589C6F6 C5AE868113C8F4C6 5BA8271F71D0CE92 A58EF9424A24AD41 5A130C4F7B094809 334F3A182FB9980E 3FD6ACD24B0DAC4A 10CB440E96B8C551 41371DCD9536F80E 5DA71F680254E784 7F6C2DB79977E8FF 34572FB415919FA6 B8B258DEF4F59828 10FDE51A7DD62958 5A9214FE13220C52 74756C09BE7BDB3A DA56A79518F98955 EDF87876DB01F636 2EAE331A71A4961F 8DCD93BA53461725 3B602F24F3CD4CBD D4F9B428398C687E 83664FC98EFC8AEB BFDE4932FD08371F 571B41BE2A8A5F84 AD78836C4C230BFE 67DC7395716F4968 45202AAE455C33CE 457F7FF0635C84D2 CDF0A99379FD0328 E5EFA09B8E4E7123 32B13BBB3B1EEE11 E26DD37C5865CA69 465F963E59CB1468 884FB798549DC76F B583B02914CF4C46 4887B974F349B74F 2231505C863FEA36 C8D8BAA51C2EC5EB 86C6A82CD81EB965 2FD64142152BC751 A1B0B7FE395CDEA5 377447E56D300596 BE5EA8BF0F565FE7 170E0E2E80551C37 EDB18DDB18FC1F0F EFF2C9262B48A05B 2DC5FAAC2334123B E770CBE8F2E6F580 9101BAE43BCA42B3 94F9507DFB70E07D 77248A2F9E8077CF A7F05D01AC3C05F3 5C09FCDE6AF55AA7 86CCB23DD7BDF74B 78909C675CC16BB9 ECEBE0F08452A7EB 4C80A9C65767EBEB 91FB31E4BF2DEE72 BE25DE19990A5898 7425AFAFE919C50A 2FE226C3CF59A9CD F00ADD7875B90A1F 9C62CF5A16FC21C2 C45252F515A8C048 D904C7FF4DBBEAF8 3A57564D136A7DCF E983A62B976705A6 062FABB1B9A2B679 E09613CA1E8CFD7D 8E40B85781B98CD1 D9CA51513C83DC01 F22374B35F3B5B08 24C3F4F133AAD3B5 B2822265373ED747 C1336823B4A5319A AE9AF0E4B1AB6244 E84643FBF601EF80 CDCF3AA42EDF8B00 6E887CE45AE12F19 DD3DCB11B73F1B91 3BBB9345EDF72450 D11A6352ACF8FD63 96B8D6DC0027BBB2 9C19B61E810B3BCF E434CD2F1C3DF0F5 B95F1F530D26D4E8 1E186BDC92517771 5AD1BFAF1A66F8A4 72A7D48589ACFEFB FB6A94F5101295C8 26D45317841CA91B 76EA60204DD8BCE1 C9DD835FCDBCB232 4063136357580C51 605AD4184E0050C9 23BBC0C1604596F6 197FF05CED9B1F45 8F484AE3F424A2B6 E8F764D5208ECCF0 FDB4A34F9E6CA794 9AF9F36508495854 4872F69108DC813B ED1980EE3B210A3E 2E4DB8B723A3AA44 D7BB12023C6FF8D4 108C94AD27816466 2EC88BD65F72CE72 4EEE4936C1FDE47F 61B705CE5858AA66
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302201559 (name+title). Key = MD5(password) = f9a867266abae5cf623f381bd5730579, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 51b69d4a-0581-4135-a79f-ffe39cf82898
  2 4be49960-57c7-7ad0-9510-35c4070807ad
  3 6908a93a-6f3f-69c5-8649-5f4f8c57b25e
  4 a84cd4c8-3ca2-0f2a-b079-e2a100a55333
  5 58c42b99-84a2-631e-866d-8c5dedba2d3b
  6 bfa12085-5fd2-3e4c-9613-954fdc341ceb
  7 6896689d-1322-5cc0-91e3-133f534521a7
  8 db5db8e7-21f5-7dc2-9be6-6af4126c5a0a
  9 3c1b15fb-0dfc-145e-9f82-b48889501681
 10 ed56860d-91ca-071e-a2bb-bc18b48f015c
 11 d7aaac1b-1034-2b64-8210-1b61fb421b43
 12 d801eed4-6d80-368b-ae4a-c998f7c16506
 13 820ff71c-dd46-48b8-90e4-77b33845cede
 14 01240734-b82e-4001-acf3-8c63eb6b2a22
 15 ff01e52e-b404-6d3f-bcaa-6d52f8b6c79d
 16 b56420fc-7aee-8c2a-803b-bb11ac9e31c2
 17 227eac60-737b-55c1-b780-c8e26fadc13a
 18 9023cd0f-4f7d-2747-84ee-4008822e9b4c
 19 c73f8b14-ff91-1dc9-87ef-d313fb345648
 20 717d599c-0f9e-6d23-9ccb-e5f0cbe1b923
 21 2fa77b40-0d28-2cda-baac-1292b8923680
 22 040c64dc-1095-5e21-b27a-24e7ebba2e2d
 23 636d249c-69b5-179e-ae51-a3587893ba54
 24 acabe76e-1775-3dea-86c7-328812c6e3f2
 25 33058573-fd39-4736-b065-6af99d5c5b0e
 26 7dd592f0-cde5-13f2-a8b5-e53141009b7d
 27 d6ebbf68-5527-5205-a7e0-1906360cfdeb
 28 50694380-6f61-5cde-a376-1152d0404fdc
 29 ea2d3257-2c70-718a-be98-66fe944ab3ad
 30 1e29f415-c028-4c51-bc70-2bc494f6a0ee
 31 dd9b8eb5-bf94-2c93-af4a-4fcf530f463d
 32 1ee10f05-35c8-563c-9d57-fe4e0b1b8d65
 33 ea67deef-21a8-5ebb-9d31-1a0984bcc349
 34 b0892f22-c7f0-8534-aeb4-cc2fececefd6
 35 e706c1ad-27dc-87db-9250-a12af6bed322
 36 e8d037f0-820d-1cf2-86d9-e69b6d8af37f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 476063571023446852162513415574255881. Exactly this sequence comes out of new Random(794).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 8 of Probable run 3 (seed 33,600,187): new Random(33600187), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:24–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs