A858DE45F56D9BC9 archive

201302261720 19abem

explained decrypted filler

seed 802

Metadata

Post ID
19abem
Title
201302261720 → 2013-02-26 17:20 on A858's clock
Posted (UTC)
2013-02-26 22:20:59
Timezone
UTC−5 · title 17:20 against posted 22:20 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302261720) = 85175eb359a33e856bfac5f990e30667 (name+title)
GUIDs
32
Filler GUID seed
new Random(802).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
46 · predicted N = 32 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B71640AF8E102CCE 7020D4BE48892088 FF385E4BDCBDCC25 DFFF0CED39F86327 8C07A8359C7B91A7 FE307EC4B68423AC 67DAB3E1F2FEEA32 947DA5CBD2D0B217 1DA98D82E5725AD9 B3EB587221A8CE43 CD0AA4AC033AC73F 191AF309DEC93571 F4AD6D952D9D0CDF B98785F0100AC724 B5D96E938AE7B3C0 C95D2FA3D79102E4 135938F3935DEA67 F7004233AC2392E0 79CA01BF552201FE 0052DDBDA3422932 52B3BB460256D6FF A4E5F78C60C40180 129DED5F905B361E 1E1F0EA6139F7BAE 1CEA9D10B83A36F8 F81C4BF085169095 8D5802BE7226F416 2A76E70E6898327E 20B27684FCB168BD 8F6212453C7EC1A5 6469C80BAA5C27E2 E193C29008A2E640 7EFE0749A8FE9F83 8C1B2A1E68291E16 01F2135C44907251 7516B393B56C58D0 6ED8FF4ED2653529 52677A8930F4EFA0 0B9671F4102CF1C6 6081BF1A54DBE211 18BB5B8B89A8D411 E559BCF1229DADC9 3E8FD00EED0ABB03 D5C24B6A3DFB3C4F 658AEDB62DB5F8ED DEDEA6101E64CDDE 203B521CCADE7F96 AEDAAB0532770F83 358EDFF5F8EC6AE5 3A8FBC1E522F331C F9ECD3B1C3EDBB89 969868503A28484A BD86AC34DF718620 A70B0D7B602FD641 E943D60050BEC16D 0009CF6CE5D22133 1B20CCF0EF04B64D A509B15399EBA2D0 6A4C944313FFADCA 5FCCB63C56FC6D9B 1D068324C4CF1433 F57DF282DA86E814 6BEB3BD52136ADAC DAECCCD0D2E42EE2 4FD7D18249DCF321 CE277B19143D3E1C 8549055784A3C21A EA0E48A11F924DE7 FC583A03543ED3EE 16244C134CDEF69E 53EF1DFA22B879D1 1B9F3DCB0290D387 7A076D971D24D5C0 B31096BE446F8AAB A87E3495790CC650 7BC6126ED7A90BB6 24B84974CA0BF605 0128001ED3DD168A 72BD56E3709918B1 10BDF0AEC3209472 17141FAD89ED9A9A B918329443D825FE C8396A9A572FCA0A EA30F34373DD6E7E 3E6636A53885AECB 7D7C05159CD2B504 E5E8C3113551E9BC 4D4DEBB706D848DB 1FBDB1E135646E8F 2BF5DD2E7818A301 018E6AB6EA2200A5 8B1795B0509A6AA3 A8E00DF3A2C609F5 48A3BAEA9781230B 24470BF83F257F9D 0FBD1E0A2B5A55DA 8EA6673253ACEEA3 30D75E2E66F842A0 7D509DDAF09710D1 28D1C840D2149952 EF03C3B48CD604E0 3F2164DD6368E70D 0E325AE874C41802 18BB296FF722AE6A 4F7FCDA6F2646E7D 251216DE65FF29CB FA33A9D8B96A6FC7 3A5C4963E4849568 BAC59CDF32843885 9CB57C9CB3000605 BFC7E034B3F341D6 175AE82AAA709A54 A3B007E012B628C1 143CF376670CCC8E 82EB048C7620EF82 40946DD266EFDFE3 8081D725455CA135 CA9FAABB9888F19B C8B03D0B295CCCC5 CE8945558D5F2DE3 3D238C0C1340FA4A EBC75C8A7ED93CBB 36A6853F151D3BAA 7D1F3634264AC865 1E4B45640BBE3233 787A4191BBABD9B8 EBFD973A6C425BE1 8E46F40817416D61 652F00FB2F4F4AC2
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302261720 (name+title). Key = MD5(password) = 85175eb359a33e856bfac5f990e30667, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a1faa862-c3d7-6f80-b89c-3e73245c5cd2
  2 ae7fbe32-9351-1ede-911c-6ca50f18d8a3
  3 669d28c1-8f8e-3b3f-837f-b26fe4f56f43
  4 1f2acb82-cb9e-666b-9b5d-e8ad16c1356a
  5 204e1fb2-f0d4-209e-ace1-88eb33dd443b
  6 22b89e64-9fe9-3072-b376-84b82bb543c7
  7 26217adc-5ca5-2e5f-b231-05c11b57bebe
  8 aef85f2d-2721-707d-b86b-fde6adfaeaf6
  9 fd2ae36a-2c4d-18c7-ba53-7689f025f7fb
 10 c98756fa-089b-04be-80bd-5aa7c12c42fc
 11 3e2f31e3-9a46-15de-b8be-4f48c9719497
 12 5510909e-d825-5388-bbd5-175394fe2da7
 13 bb9bd681-ed13-8ec9-911d-57c5f91fbc1b
 14 1484fc2a-c2f5-6cdc-afd9-f3a9f7b3ab73
 15 6c79fb56-09d1-35d9-ac9e-8b6222b36ac0
 16 f90bcfdd-9829-8d42-b5a6-7416868ddd40
 17 fe2e4076-8cb2-8537-8254-aa847021607a
 18 ad2277a9-75e9-26ad-a17f-4ae03d00e4dd
 19 1a6ff0f8-5333-385a-a8be-0ffa2526546f
 20 f7199edf-5b5b-7ea0-bf0f-6cce2877f4ce
 21 d6e4f894-1711-37b9-816a-7fb39595b1ce
 22 aa4d5c4e-8b92-553d-a2cc-a95f74193cf4
 23 37fb9919-e992-432d-bc01-4ff82d9e5359
 24 5125905c-2416-1cac-b9cb-04175e672710
 25 0e4260e1-ff4a-2371-9b7a-2e72f1b6ef39
 26 cb864d80-71fc-3449-935b-a6735cfd3557
 27 efb8e026-ef5e-4794-9b46-6289de8618d0
 28 aea352f9-7c19-5edf-b217-4c69f7579aba
 29 1033ea7e-15c6-079a-9ce6-47e90a3248e1
 30 d7ffa5ba-235a-8234-a1ea-3b1fb82bfdc4
 31 1638b56c-ea67-2aaf-914c-53146aa38ff0
 32 76deea46-d368-6d00-ac11-037a15ec3df2

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 61362327101586388237354123450826. Exactly this sequence comes out of new Random(802).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 46 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs