A858DE45F56D9BC9 archive

201302262144 19avzd

explained decrypted filler

seed 654

Metadata

Post ID
19avzd
Title
201302262144 → 2013-02-26 21:44 on A858's clock
Posted (UTC)
2013-02-27 02:44:58
Timezone
UTC−5 · title 21:44 against posted 02:44 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302262144) = ed258e195dcb0071413de290440fe0c6 (name+title)
GUIDs
36
Filler GUID seed
new Random(654).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
50 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4EE36071D8F4BCFD 0AAD6CDE7285F011 772F48B2FC483413 64925803991ABD48 DD35915D157A29D7 709453FD37BB7F22 405D8E5AB9FF8437 20FA3AB9FC9FFF3E 825FFA3B7F61D916 715653719A00D5F3 400C83CEB6EC425D 07720D01F5A9DB03 61E0AAF6B3D855DD 0B583AFB36653FF6 5CD65275BCD77592 BF1137F78E7789AA D04D768541B5F0C2 9ED964661B99BE43 60649EEA0A4B4DBC D62384E345C2C03A 9548F11FFC8B5E8A FD9239D6847769E5 26F8C3158CFF391B 4BAFC3551C0679DD 1E9C226C44888BF0 8932D5F9E9FC0ACB 9780F2EA1C16FEA9 D105855FA6F211BA 7984E46F5411DDBA 5F30BBABFA80582D 44388192F834163B 1CEC48A6111056D0 9CD698C1F988E59C E830C0C87E85110D C62B3D3014E9CA41 66F0CFB2F0FCDF8A 9AD63C474A8F58C6 F6686E59D649BFF2 79FE3887F539F2A4 1432D05436B77AD3 8541A2A9DC3E2BCD 2BEAF8C907EC13B8 B6E50F08EDB6B789 19B1C4BCBE7DA68F 258F2390525A56ED C5619E60041283EA 7ACE5698E38965B3 311068329DDD3F93 8A2669FDB5C5E274 19BB366E6014EBCE 75A9DC51A7BF475E 0FE9C47019746C32 71D4E2E50FAC46D3 104DBFA284ED3979 F85B5B0CC7F7F7FA 98B916CB011D72F1 CBFA1AB499CA56E8 3121E97A56410A87 8E1A492849AEBA12 BD4667F1B4865590 0CD4CADF775222C1 55CEF3F21FE0FABB 12F87214698FE61A CCED40813AC23402 972A964D2A194DAA 3A1AB37AD6F61426 8EE64D8F7DC048DD 1480C0F8A18E64B8 4DD9B483EA0AC5B7 F7B255B19A326283 F14925C641D79A4B 2215F2233BA5A2D5 BB446B0E6E18FA97 0E0A601F10DA78D2 F659FBAEAFE67517 58CCE6E9EE191FE2 154D38528A9A1106 3DBE501C4DAEA53C 8235B1E29F400779 90C59B2DCCF92F03 C5A5E888886D2509 D5AA5F504A8B2AAA 1FE78C80E988150D F8ACF4A742E0912F 18660806B157DDE1 2B73CE748AE4450A 8FC4F42F927B8A7B 4BE842EC900F0DD0 97D2D96147E6DF4B 74F0ACBE6351C73B 55E656E461503B5E 656E4970BC959E7A 24146C47FA8FB7C4 F4067940E95919F8 C0BE4F1927A54846 64A3DAF2E6FC93EC 6F323CE63F7FE1D7 4DE159540CC43094 4D01957A20505231 B2B0678AE6FBDF0B 9E28E30496AC9B3D 3BD75DF2F46843B3 B2F171ACA58EF2DF B805F972AAB9EE1D A2C4F67534D0EA51 6F26CDE5C3C4B5C8 0D883152D1E67346 21E7F8067D345ADB 7CF41D961B8E9314 B08599C5A4C63D85 51BB64876C16513A C287B7E6ABFC87D5 8182069D05CBD149 24E5FE76D38AD2EB F8DACE6F7E86BF75 ACDC5A1DFDCA9AEA FF1FAE940DA97D88 19D17E9FA84F5B2A CCA5F90C3AF6EEC8 721C0F14E27CDB7D 679FCAE7B69FD784 13A0A5A3A708E256 699D4E3CDEEB337A 9A16242AE2DA671C 0B4D95FA18A728E2 AF6A37BF61E78589 E98088431BFB9E6C ABAE07F5F664539A D2B499D8DC782B23 F83F70F1E4F4FE87 FE75E74403E56535 FB9E4CF588554A58 3EF99C9F0D4C5145 ECE8FE4DAB2D32A5 6272FE106E2A38EE 303E87A8B98C72D1 ECB80E33651FCFB7 827A955C25D1AC83 57BCFBFBFA4BE0C3 2F9C9E5A630E122C F8D2444108148024 1D0CEB67E0E85BA6 0B22444090AFA002 2524CAEFA486E2E1 7B4D3AB60D2A1799
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302262144 (name+title). Key = MD5(password) = ed258e195dcb0071413de290440fe0c6, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c1feff71-09b4-3e63-9c02-c2be81976bd6
  2 2cc18a39-aa4d-695a-82fe-fef257544b83
  3 df105624-0b2d-86fb-b3e1-4533be0b1bf3
  4 0d27c26e-0702-12e6-96e6-f4390df4fbe7
  5 36cf841d-6b92-4e0c-a3a3-137a9e13e89c
  6 4cefbdda-cb12-0373-a6f2-982c8ffaecfb
  7 58ca35b8-9b0a-8f55-b2d3-79d7d721c264
  8 c4a634d4-4148-4994-b6e6-d45cdfac87f8
  9 3f9a07ea-d49f-7ad7-aa9a-3b53ff82ca9d
 10 4c09e426-88af-3de2-9a7a-a0a04a22150e
 11 f3ee63eb-a0ab-17d1-bf96-0d684909a467
 12 4fc09001-0c11-022d-bb87-f7ab40313e89
 13 c5a75f21-502f-2ea9-9ddb-952f7fe1477f
 14 fc137e19-8bb9-603c-878f-d6b38d88dae4
 15 c49defb8-9f64-6423-b622-d0f723e5746b
 16 673cee77-255a-4c0a-8a6d-7b2b91bf218e
 17 79bb48be-fc3a-61cb-b5c7-bfcb8f6e3ca1
 18 90ffde81-dee2-48cf-94d7-46ee0c49e09a
 19 cb1e755f-a212-3326-a3fb-529a9a4a4ba5
 20 b86387a0-f380-4e6d-a359-0f4c3e1ca6d3
 21 b340d0df-568c-6cf7-896a-c7b7a2634f33
 22 ec8884df-8c29-260c-9b53-8ce78cbf24eb
 23 fecc3297-d92f-4d56-8afb-ad2b68f96f28
 24 69b85c9f-636c-40e6-82b7-de741987df67
 25 7043572a-78c1-73a9-ad3b-a2518210f46e
 26 7e5607cc-9b98-1eb1-b7ef-abc1e977cf51
 27 bd1e2228-6ea3-14bb-9ace-b399f8d2e888
 28 755609e4-e578-83a4-9934-882561ca796b
 29 737e9add-cc1d-1af3-9cdf-59e9528c04fb
 30 fc98f7ac-179d-7e38-993f-087d8fa29990
 31 233f837f-05f0-5e39-84d5-99e1a7f1a397
 32 2d9ec43a-91ed-68e9-9a52-ab7f0c328f98
 33 c444c82b-a683-26f7-bd4e-d0594643dadc
 34 f2506f92-01c6-32fd-8d5b-fdae1e277bf7
 35 8a810c5e-5d93-092e-8268-2789523df00b
 36 829932cf-8f2a-0ce8-b520-41fe8eca07b8

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 368140847310266464346244711817562300. Exactly this sequence comes out of new Random(654).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 50 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs