A858DE45F56D9BC9 archive

201302280008 19dofj

explained decrypted filler

seed 513

Metadata

Post ID
19dofj
Title
201302280008 → 2013-02-28 00:08 on A858's clock
Posted (UTC)
2013-02-28 05:08:57
Timezone
UTC−5 · title 00:08 against posted 05:08 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302280008) = 92aa38f32be259110d7b9ff6b91d313b (name+title)
GUIDs
36
Filler GUID seed
new Random(513).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
74 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B7F94B1951926B9E 17FBF1A44E3BCC37 F04B3723BD95EE5E 21981369F579DDE2 0859CD093EBB6BFD 734C2227D820213C 9DDEBD91208C2B87 89D3DA17BCDCA7E2 032D7BBA40242E68 130E73EFF8AFEA75 69A56AD8102C2C71 20622DE321E9526A 0327507DCA3839C8 FD2C9662B1E7AA4F BB1AE8D722C2B0D2 60FCD9EA4AB47135 CF0E5ED1F7A480EB B03A914F5B5E5A58 2A6ACC6609498482 E529CB4FCFB31C7B EF9CC8446FC00FE3 61D6139EA5E7678E 7799DAAB0F8D874E 655DED284A5D594A 7F0825221C7923D6 13277940CFC41C24 D89DFBDE381ABEE3 D6AD216E64B9FA52 67E0C262FB5AF230 E3CB8EE1FB46DD33 6D78EF0670BD4D6D 5013C6AAB9949093 DC1D3DFB817073E2 2A8D3F58666EFC80 3A59820781515313 7E2C5F4F73629C1A 275B3DA352DE9741 1B03F9BDA3C3DA8C F6535E21F5AEA7A9 BC020E4FB7A0E408 5A78D71EA18873E7 69584377FF8976A0 254EB125063264C8 34B77E92BF26CF61 7F15F5D57413BD0D A2AE3555108F0FCE AAE7030C65E9E654 0679D0DE0A2BF358 B280754F88F548CC 4E963E94D66D4CA0 B194281F0FCCC10F 3C409302E33F081F BACCB65DEE8B35F5 79A5856984574F79 CF3A9EDD2EA5969B F5556D78FD2B142A 464EFAF1C533E870 53D58FDBD14388AA 30FFD634FF6E0D22 73658A04C899425D 6C275408DF5B4155 816ACE4296F3F65C A915760E89B5B3EF 50850154965E89AE E095B9C5EFC4321F 4BF8DC870CEB3A08 20788EA8FDD63407 FF06D05C6C9B0CF5 DDE15AC1D13E11AA B96D810CFBBC6EBA 227D83940B36F80E 63967D79F367E2CC 96C15E776CABF0C6 249A0FA86253FD6F 3BE91E0FEF897537 D732EE46BB0E11B2 6FDA67D4474D1806 7B4D0D6B7238EC47 110905A217AC245C 3E64DD9137ED8C81 5EEEEDB414CB3A76 75721EB3566759D4 51FE2A1F2BCE5098 3192B56F104F2C58 CDFCC706FABD2EFB 395392BC84026FAA 54BDEA2D4403B7BB 2C1E32813C8EFBAC 0FF1B02D3948E9CE 207ACEEB95D545F7 C81AFE579025767A E1582C19AF22B43B 4D1CCB285FA58FFB 773997C75120C0E9 6E8D360B1791C0D6 F10379A94CCF1537 3BD98ACA049C1BE7 A2A7966746595880 BAAB5194B6E1F9E0 2AB9953F902FAC27 0E8226F66301F42D 0829A2E81334A351 9C5EC35B3B32217F 10F2A2A62A78EDC9 B832138325C7D5DF F7E91A2A3471622B 8D8169FEC2ACBDF5 DC6135CE5E027C8E 7E6B235D820F8B56 9F8150A3EF1EF694 F8AF9F204DAD7E95 3FD435D644B7F76D 51F83C4C626829BE 3B7C01FB120E3056 9330A5E8F92F3469 84FA79A20857A9EF E6F610F6C568E448 612E1F2942C52991 8B105E0698644CEA 5A04D2C3A0FC7806 47CB47D16B12F0CA D2B248883DF86DAD F9BD739DCC8FF21E 8E471608855ED060 CB5A3E69B3227D09 E3E32E17C35B85ED C7E6E71B1A9DA6DE DAA11B13D7FAB5F3 1A35725DF2DE1745 E59D26FCD5695BBA D350B04B81F672C9 4780DC22699D359F BBF8948B45991F5C 9BA0C17AB8E846C3 C5DB133A1BD06AED 36A1D33F05849733 FDD1AC336239156B 36DB7FAF8CADB4A3 B543367C966D5F8E 7E97936499B86F77 9568A2AF70DDE2F3 A9EC12FAF59411F6 0BBB15FC0E7959FB F9EF46EE3AF94B8F 9119CAE8D56EC7BB
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302280008 (name+title). Key = MD5(password) = 92aa38f32be259110d7b9ff6b91d313b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 839a9946-967b-68d2-a8af-28f25d3f924f
  2 2f343239-860d-3969-a010-9ecb5ea6b26d
  3 73feedaa-a941-3e3f-bf39-ab516aacd09f
  4 1efb138e-f1cb-085d-86ae-55ccb7b1a147
  5 cfe65162-b981-7c72-b9d0-b2b2bcf66da6
  6 434a6e47-766e-7235-9824-15c9e99bbdaf
  7 baf9c564-444c-6202-ae8c-b86979c784d6
  8 a5281ccd-9e15-755c-966d-51ed0619f6a5
  9 67c871c4-b84e-30a3-a1ba-383733e60d72
 10 ca9224e3-f843-38b9-900b-9f0141c8da8a
 11 6af68a97-b4ff-252e-9d29-0dad4aaf833a
 12 62af84ac-296b-8802-bd00-509565209837
 13 87eb6768-230a-2cdc-821c-0e398ee5db96
 14 7a52ca55-36c1-3479-b548-113f966c3815
 15 05e81781-c2b9-0684-b9b3-eebdd3d8bdcd
 16 2e080a88-9a2c-37db-8ec8-771d3aca4d58
 17 07e2be74-5792-4f1d-91ce-303cd8eb66a3
 18 d4e68047-fc49-0d8d-b251-7c82404b8bac
 19 ba5c9efa-5dc1-5780-9ee4-27b22aa01a52
 20 efb52dcd-ca29-82dd-ab86-4c037a7a6b66
 21 4ca9a17e-1890-882b-b26d-aed06c9894b3
 22 32d6dceb-2972-63a3-b8f6-124ee5efbaaa
 23 ba579551-6e9b-61c9-88c8-e458d9dca0a3
 24 b27108bf-5905-2871-ad07-7462d6cfcc56
 25 fe186ba2-8b86-8a6e-98ab-e25f73031969
 26 b27586ed-eca6-408b-979c-c199926e579e
 27 cf520110-31ce-8c2b-95b4-fa038903024f
 28 646ea160-7e0e-4dd9-be18-c3f1e0f8968e
 29 014726c0-faf2-2fdb-a821-f17f95f4fe04
 30 d42f5b3c-13aa-2275-bed7-06e057e75ac2
 31 e983df28-d38a-5bf0-8840-38a642017613
 32 4ca5714e-a878-583b-b61e-db21a54eb022
 33 1a2307b1-686e-5932-89e5-6e62e2ed835a
 34 ad9c0097-6d75-768a-a99b-7553fab8715c
 35 5b0003e8-639b-6a89-a331-8ba0cca12ec4
 36 0050bee9-6cf7-839c-a0cd-a32d9c402b0c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 633077673328230340588662848422555768. Exactly this sequence comes out of new Random(513).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 74 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs