A858DE45F56D9BC9 archive

201302251814 197zrd

explained decrypted filler

seed 724

Metadata

Post ID
197zrd
Title
201302251814 → 2013-02-25 18:14 on A858's clock
Posted (UTC)
2013-02-25 23:14:59
Timezone
UTC−5 · title 18:14 against posted 23:14 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302251814) = a3f42c87819f5ce29f39b4885a5a8e70 (name+title)
GUIDs
36
Filler GUID seed
new Random(724).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
25 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 4
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

03CAFB107EDA374C 1C4BEA55E95C3DA8 9858FDB1ECAF3438 8B59B6CA8BBEF087 7CF2D5C4EFB20E8E B107CEEAE4BD3D28 F9F1B780BD9EB9F6 4DA7E36FD2A076F1 6C1289C0B0C5A5B8 6082F1196AE58C5A 554A90745BFD57F3 1F3735AE12734B7C 63022BFD224C7782 8875F39292670867 E5E3586EB85699DF AE0536EAC0D73116 99BCBE7D1AA0A256 DFD0C5433ED54AE0 0140EE1A09BEDC34 0A69F0F8F0CF7FEE 7421FB4004FA66FE 04A72E8D1880AF9B A34A01C6423529B2 94D7DE1345617C7A 1494950CCC760430 76F2FB61AFD844E3 588128ED03F73485 2EA753E7E2F7E9F1 6A479791CEBBCD9F 25E2A3120EC2E58B 20C7C2975E87CA4D A1DC362F88F9F2B2 6C8FA9707E22D3A1 2DC211D79757DEA6 95BCD22C0D368DDA 73025ED1EE4078E2 3FCA35351F68A4AA 273AFD41B60F685A 6A8FD4995152F35A B534EFA763796ABE 9ED748A83530C35D 9C154EA9D8739F57 50837692A42BCB25 387FC3FBB8A8A947 E9409D4950BD652C 990C76EA595A0249 CF382388E5F0AA54 E14BE9A98DEB41C3 27ED68CDFFC7FF6A 66661741B71DE271 019448C3BB513674 C85144C81CD3EEC0 7891DB4A2807C7AE 4FB807AD5A6220C7 4E2B498F3CD82627 AA6C6C985459C2AD ECE4AD3A7DC694F0 E7DD50F28025362F 6D58A34FC9A13AE0 4910206460B247C9 0DD6F666CFBAD998 A25EE48509A62C68 84D355D3644B6B55 FF6C64D940C59E32 9DA46DBAFE3C094F FB43430EE432553A 6200E4708B74D6D8 CAD5A1EAFB32D1AE 19789DB9EBD72A90 3EF52D832771A19A 1185E247CBCB33B8 D7CEAB3D57410F01 D3491F50FA57C113 763AB141B87052A5 D5E7ED2F3E48A411 4B79C0871B44C5B9 F751B4B6B5D56C16 B56E5BE8B5B07189 B061EC8A9A0C0602 EDA20E8B9AA7AA4B 3F3090A65323EA15 D3B3F0B9D29B24F5 E337BD39458DCB7C E7AED32CBA0AA4EF 0A25290E4D8BF45C 2F19EEB404CCA2DA 0FBB6A4E9A3F3A33 ABE7A260434BC6E8 BC2B30A304DC6181 5D7144A601D52488 64F7A570EAAB0AF2 3558AE6CF6CF355A 368BD49776203A21 EA42D40053F84314 9EDF4968757C27A6 A1F74EF935CC9B6F 94D6B11A9CACCE23 9B90F0D9AC31354B 1339FE14E8FFA771 72B59B58FCFEAC57 D75958FD42795189 31FEAE6CCAC375DC B06398B0EB338392 6169EC61E7030F3B 6F7C9362E0EAECFC 37E865951217742A 4D6A98FDA8A89CFE 890A546D0207226B 096CE5D1976B23B9 71798677D49E9C3E 2F127040BE7EA083 93E63FE260FB62BF 12CDD4D488925392 7845D81578FF9DE9 1EB201A19D0AF176 93CD94BFBBB335FF B76F376E088BD725 D6693D3CC7441F1F 56552CF73855FBFF DAB15F5E40E47C8E 87BAFEB054749D61 0DB0B6E3D83C90B2 625E27165E38253C 30216AD2E121FE62 19D3D0ED23623B4C 349BB81DE984058C 4765FFF9CC873D32 C88D3482F89BEC16 FBA374DF8E9269D8 A2A312CEA29EFF4D 6FE1DB07D8882CAF 7A8620314899BA35 0687034E39A4DCB9 D56E17094A2AE544 60A7988C16A3C516 323E8796DBA41A73 B255C986D05B63F1 51E795A1DC9826DB 12D6F7B7C776ABB3 E6E158A2A53C05FC 820BA0146485E696 226FE76804C4C833 3B647F42B28A4BBC 1E4E225A5C03B493 2B530EDA80129B88
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302251814 (name+title). Key = MD5(password) = a3f42c87819f5ce29f39b4885a5a8e70, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b14c9118-1aff-8b0f-853f-a573111371dc
  2 4750c868-085b-20eb-a725-1cf857009f27
  3 149abe96-2786-70fa-b09c-c17d511135b3
  4 01c8b493-1e7b-0024-98a3-f7e73f6fb9e1
  5 3b9b2a51-43bb-03db-95d2-f0c09cc02e33
  6 cc2ce25c-22b8-2938-882b-5f28e0a60742
  7 27cf3b88-8482-233a-8170-75100a97a316
  8 94040131-835d-5f8b-b63b-262a89fe8d0a
  9 d09f3783-d7cb-431e-9e8a-7b687e9383db
 10 e62a4e45-5dbc-2088-9e13-d8462e876a34
 11 c49a93f8-610c-60d1-b2f9-95dc63abcacd
 12 de72c3f2-0c5a-6fbb-84a3-0ff277ec3977
 13 0a9bf2b0-c245-32b4-9c3a-bb183d7b1904
 14 c07f066d-6e7a-1b17-9959-ec0453a93e55
 15 bd5084b8-3718-6a26-aa36-4ccd98c028f6
 16 142b128d-75d6-1159-ba11-f8008f7a60b0
 17 0e3ab866-dfee-19f6-879f-27536ec8e51c
 18 1cd529b5-74ba-7b9b-a426-5ef06e6cf6cc
 19 ec33bcfc-83a3-2a86-bfab-96f5c2b8ab12
 20 47998556-c513-5048-9aa2-cbf55d2ff206
 21 b572feb9-486a-0a98-bec7-6b1d126f6827
 22 ab6e5af0-9a79-4691-8537-5320aa4834cd
 23 bae34af9-2abe-31ab-a75f-ad35488b0a03
 24 5edc50ae-ba8e-85e0-b028-f8e5b8d17404
 25 69dff5a4-ec33-5daf-ae9a-2824af9ac6a4
 26 a56a45a9-2f22-188d-98f8-b8f971b2777e
 27 ab874de8-ee96-31bd-9f98-f460030ae6b7
 28 a166d9c7-e823-2d71-b03f-2e5c65cb16fd
 29 5e7ae3fb-f696-4b65-9345-0e9c44283421
 30 d536a9bb-a25c-156c-80db-140ea3c0a75a
 31 e49e0766-1fed-40b9-acd1-0c6c8affa045
 32 3ba1e3fd-21a7-1710-ad67-398c893f266b
 33 ff9f9965-312e-3683-a4d1-c015ef21cfa9
 34 69c48fcd-4d70-13db-a43c-5e0f6cb86a87
 35 a7b54182-36c2-4015-8217-1734bbc2ac20
 36 3c82f460-4281-1607-8150-1988e773ac38

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 827002254266316117250438513241413141. Exactly this sequence comes out of new Random(724).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 25 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs