A858DE45F56D9BC9 archive

201302260832 199acp

explained decrypted filler

seed 160

Metadata

Post ID
199acp
Title
201302260832 → 2013-02-26 08:32 on A858's clock
Posted (UTC)
2013-02-26 13:32:58
Timezone
UTC−5 · title 08:32 against posted 13:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302260832) = e4b676a7f788f5d8f075cc94590b21ae (name+title)
GUIDs
36
Filler GUID seed
new Random(160).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
38 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

08A0AFA64F4EC43F 346D9031BF4420CF 83AEFA8C2E091C0C D6AE0E75CBDD8F4F 3C2FC59BDAE1834B 842578DBB04D22BD AF3CE99EF3A5A873 A93DDC70EB9EB23C 063B86D6B90DF8FE A376EC290B8E4149 2F2C720407C10C9E E223B24D4539BC54 0967AE4397A7A9CF 17CAA70D8D36B242 1BC32DA05E899DA7 1FE7811C9DCE2CD6 F6A973F4215CAEDE A2770919766C9F79 97B495396DAE3D4F 87FAE04FD7CB7C59 032D3002851A8FA6 AF299E236583D3A1 3491C45FD0318E62 109EC98772E6CC6E FDD24E2C6778CAD0 7E3204DC6597105F 0126735F03BE7801 4CF31DE041ACB853 06890AE9F20DA017 F415CF6E366A4264 34D80C3A9EE5B566 385C44FB56202705 56E2240BDEA01BAF ABC4CA93E18CDA74 82FF379F167B283B CCE5A7971C1E704D 168455C1C8783B5A 34E123275F4D7ED5 A80A3EB6450B4158 FCA9EA7073E301A5 F29ECDC2E69A6EF9 0A12C3CBBC76540C 9C17B832F676A71C F08ED8377429A7AF 8F7CBD07757EDE6B 7ADC5B7CF10BF204 DB2E8058AE8B7081 2C1E578CE11A9256 EE470689244F78FB 95F7C0FFBA2080B1 6E0D5A22D8E00F24 53C96E55513347E0 9A5F27487F0E5167 83B05415C5D41457 CC5BC8CF52B6D47C 94F9D09BD4119488 DAD1CBEBDD479D79 EDFD26A28BA6D2EF B646A13010779F56 C0B269C09EC52756 818341252CB33D13 CD1DEADB97C141C4 786FB9FEA065B687 46E57B838DDC1277 FB7870ADC6B50873 8A3273D15DDD0CBA 720D6A66268CFD46 FDA3535972A3AE4B 39D3AFB8D73ED4D0 AFFCDEFFD83EA471 D633B581CFF9635A A8730BE7B5D12D98 EB552E4900896A9B A7BC1CB1E680C011 89B926B6C177F2CD 1231E0BAEBAED38B 023AD53F54DB35B3 30C61D526BBCC2C5 7C73766CFCDEFD5B E5F3F40E993042EC 32BCEF6131760828 1BC1BFABC3847943 4BAC42BDD5B902A8 0FA1712887CD91D6 2A1E00ECB9ADA8CF 8BF867FDAEDDBC44 3DCBEA6DBA46462F A036733C8BD44F68 3E6DBE82A4DDE49B 3536515C57D26B99 898DB5BF90F42008 21B474FA5A7C7E6E 094320835E243B9D 2B0471D0CA04111F 9FB8C3D09E906269 FA5987DE9FDABC8E C1251B6E6162408C 22420E77829F56ED 48BFA5A3531B8E6B 77F7FD9A82F05F0E B28DEC87D7EF0B75 9087F18EBD075F58 EA1973991C18E29E DDFD968759732A4D 6B3B9D246F5A6C5F 573E541EE66C8709 B4357D582C6253CF E30D6D050C01F094 59307B2A9A49FF41 51329FD08FADDDD0 DA4E23C9C6B6F677 6DFC3DB0037342FB B8DBD692E537B5E0 CBCF69491D283BFF D2CF07F550685A57 2AB29A2192717E68 5317DD42C79018E4 97BD30E4B1E17007 58B8FDFB0912A688 71A39DB6B6468929 15324E6355B8594E 9F56F9DF46A57A44 62D3F7697CF76DC4 4C622BF8C31973D1 5DC8E5607793ADDB 4ADB2469606CBB0F D5A513E7AD9C2596 3B2AE1FE596A0243 01E7864A5464F36A 58A6ED3170D1CE6B E0B2C7E066B2A8BB 0BE389B1E635FC6D 7EED71072BF7582D 644EF5D9F5A43D9E D4330797C768B9F3 FC726C89A2358AD7 21D714BF8188BEC0 650ABC4E518FFF36 6704F4322C781D16 D8007361C94E942D EDEB0E1C9B879856 30978BD01FDD1CC5 322CA4FD3FC345F1 15B7FA4AEB927CCB 471074C0AE8E061D
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302260832 (name+title). Key = MD5(password) = e4b676a7f788f5d8f075cc94590b21ae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 517b1678-467e-2a97-8a4e-15cd04d0c074
  2 5674ad79-8e31-6051-a1d7-4bbc9709b546
  3 10b8c562-955e-508a-8557-e0832466144c
  4 7a0400a1-b746-6742-8abd-230e3f259801
  5 ec35a47b-e064-31ff-a5aa-e11424dfb14a
  6 3d4246ba-9623-347a-a376-3dd15c66f6b8
  7 63a8d6eb-dec6-5930-b554-a32fec12858f
  8 2d2595d4-1668-67d6-807d-3f05999b5fa4
  9 aa71cfa5-a01d-6d21-a4de-33ca30b4ff5c
 10 2712cf77-ec66-2e07-a619-a41069777aa4
 11 dca244d5-7710-18c6-9d8d-1bfa891f5e2c
 12 f2947137-8685-3dfa-ab98-83c62356a994
 13 9c79ae56-bd15-5098-8f7d-88f69093cfc1
 14 5794256c-8940-6c88-abf7-40a8674c6304
 15 7d4029b2-49f9-8c3b-b93c-ddab0e92f7e7
 16 60a53091-d581-8b2e-8ccc-8fc7b201f8d3
 17 080f32a5-c63a-1b94-b0c1-851ede19cd5f
 18 e27b1d5c-bd55-12b2-8543-df1077c273c2
 19 e064ecc7-c554-030e-8330-de2a88a20706
 20 74c5a2df-2889-26f2-96f7-f9005645896b
 21 c5a8a96d-e72d-0164-9044-f397d1f636b9
 22 ea1a857b-3f1f-0611-94ec-34ef2015ab87
 23 57985ae7-7a09-07f2-aacc-8c36f1a15d16
 24 498e3386-29e4-8ea9-8745-346f1fe02233
 25 4e54b7da-0489-3d2e-b6b1-335d92303948
 26 0c9b1ce0-362a-3870-9510-72c36a3ff92a
 27 be363626-753c-4549-a3f4-b7b9e94fa3cf
 28 9e1cafcc-9387-7597-b219-ad73b8a7fae6
 29 8c815af0-94ce-6112-90df-c4d271acb9bb
 30 33c010e3-18ce-8670-93ab-96ca67272794
 31 85e8d185-b3da-203f-bd41-8abdbbd4cf3c
 32 e4ce90d0-0012-568b-81b6-7c224bea35fc
 33 b1f33430-7868-5fb0-bab3-706a633b7d25
 34 0ff21514-a490-83a8-8af4-c0eaa6b97f91
 35 eb84be15-5a26-49e4-b3b6-f3d1417eb9df
 36 747a014f-0cf2-69fb-9794-d7ae8128ac22

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 265633566213568811020008334768255846. Exactly this sequence comes out of new Random(160).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 38 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs