A858DE45F56D9BC9 archive

201302280644 19e3wj

explained decrypted filler

seed 209

Metadata

Post ID
19e3wj
Title
201302280644 → 2013-02-28 06:44 on A858's clock
Posted (UTC)
2013-02-28 11:44:56
Timezone
UTC−5 · title 06:44 against posted 11:44 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201302280644) = 651a7001ecd49338000ca9ac522665ce (name+title)
GUIDs
36
Filler GUID seed
new Random(209).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
80 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1E2C87106579479F AF03FCF6B2129E62 CC22AA27CDA49AEA 0D40FE55A5CA4A5F 493B4A3382F65771 B6D8C63D034F5DC5 2C1F90450500A127 15DB03C045627CE2 8923D53BBB4FED1F 5215E2DCDA79E947 0023FDBF74DF31E1 A809BEA9791E29E2 0671A880A921E856 C6786053C812C00B ABB777C8A1F94E54 E728F6643675B92B 83C1D9080AF291B3 848C47C329D04540 636FBAF4C039852D 9446EA2D24F26167 0B2150524A4DC417 5DD34E4187D9F135 5D08AC40DC14005D B24F8FFAC962130B 9E5FA6FE4C807195 E6220FEEE3FBF8BB 0CE44D0B2556066B 393D72FF2D9011E2 5DBF751A3C6271A0 64A0B5649635DFAC 5D4903F770DA657A DEC81F737DD2F59B 1164DED6373206C8 8AD56F53783EA8B1 1210658531E7FF97 2AE0C2E1A7DCD677 86C37C564BBBC505 E8D7A72BEA2B604C 008A7FFA427E81AC 2EF5B4C335DD6A8A 8821F497BDD713F2 765B558046D39AC6 85C435090BDDD732 8812EC33A1D10E26 E34C58A68E00948E B18B602978B51117 FBB0D2CF4AFCFA3F B08C862667555D13 A6290CD37E3FB342 CB5809E076547133 76FB886B99FEA2EE C79CCE17AD5B4290 E73CA2EC8CD28CB1 329A8D4312CDAED9 13B91EBAC8021A88 04CC75E5FE087F91 81A7FC751EDF5E0F BC09BB68BD424681 B4A41282A753DF36 10ED9E2BB23985CB E521519913028DAF 20C91BAB83E9FEB9 EC738F13CA56AF9B 4351C38D3A8EC9C4 1F89800166230651 566784428367E145 1138A8B2CA9684AF D74F6528132E41AB 6B6A3EBDE324DF8E 9AEFF2309BD23AE4 C31A85A65A39DAE8 AF9FDF6534737729 B76705A7B8962BDB 9B7A12C306BC4AA0 BE4677932F92ED90 617F71C918F0E332 1DCBC5360D3BF87F 3BB5FBCF55326835 AC0ECF38CDA4C57E B5F90CA4BC23BE92 327A8D7D64DBE028 18A445C35BFABD8E 7D6A1BB05BC776B8 FACA4EC63507A7B8 94BF6FF240EB64CF 749025CC333F87FD F1D76298DE7EFF1A 52E63F7A6A00EC4B EA63655EEDD2057A C6C143A7C79BF53C E4B14CDB08CE4AB6 6843A6B95125445D 9255AC0C0D7DED34 8FE025659816142E 40016BFF2AC9AFB7 2E986EE6B2C335B5 F21315B45FE3ABAA 7060F4D1573518A2 DD86E81149C5EF19 9C80DD496DA96A2E EDFA5632B5C1DCE2 46F0AD8928AB7703 EFE6B5C4B9301868 ECDC454F7D1C9F6D 8724ED5AEF534B21 B05497E681F74F1E 4EF7AB18F534B347 ED6E898FCD3BD688 8B3BF30E826CD9B7 AC2A0DA7D17A3F19 9B837EB7A073FCC5 D04557479D172A6C F0B8C3B5FACAA678 C5C2AA195F90B845 EB14EEFE6A5C3CD8 C40EE1BF6CF3D248 3F2C5FC755621436 BB91B0C1FF688E73 4E977F434C1E9093 797A81F075D77FBD 581698B30C9486F7 F5DCEF1745F4C6C8 B43BC55314063D74 744C66CEE0C1741D D0E12CFA652028EE 33CD287B16F7F888 D84E8E635D70A739 090EAF5F91F59F80 2857610A6251C832 3488696B671BD9E2 B314130B090302C9 2A4CEC75B212AF75 36DF62842A59E9F8 A65C7552D257DF86 0EA504A6E5D18478 EC235A612BD45604 6EA6F1B8B25200E9 EB4BD91E084955F3 87DC5BDF121E2C40 DBE2FC8C90C6B54B 6A1EA969A5ED0009 9D4B22D1115B1909 E07290C545C13077 919B17229349D7DF C4D3A1AAF0BB0052
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201302280644 (name+title). Key = MD5(password) = 651a7001ecd49338000ca9ac522665ce, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1f7588c6-c905-8415-a0ea-08c47e452722
  2 284563e0-f2ce-18dd-8eb4-5d59f298d14d
  3 a95f4c58-dad4-734a-9926-eb8ae3d0eafe
  4 4118b8ca-2dc6-1736-bde6-5b03c11953bf
  5 b08ceca4-36cd-5ef7-a34f-6409e83cfc38
  6 badfd555-fcdc-1741-8cc2-8f59cba942b5
  7 a3d7727c-9b2e-4c34-88c6-d1656d0a57c5
  8 8998474f-ad4c-2c2b-9add-f579712eda51
  9 60cb538c-c85b-750d-b2d3-fc569749e8f6
 10 01e95845-f1dd-3542-8c1e-e97583ebb262
 11 a1bac475-931c-29c8-9fd7-f6bbc0cde3c1
 12 2d529227-58c6-5189-83bf-127c42f92fc2
 13 f14ddb00-c4ef-26ce-a30e-afe9e6fcb7d1
 14 7138bb46-8d1b-1522-897f-e42cd9b4a425
 15 fcadfa4a-8410-2151-9373-674f4f1b9c16
 16 fe824447-25d6-4f75-b74a-0c8c8f2eea2f
 17 1be2ee32-c347-6ea5-8186-7a2b0e039a38
 18 b004b5eb-5e1a-5744-a1b8-3c745f2e23b2
 19 a992c9f9-c01a-3051-b5d9-ade44b416f88
 20 dce49c9c-8643-2756-8300-04bb58da4ab1
 21 8339f5ba-d4fe-53e7-ae54-dc82538e3a7f
 22 3c0bf65d-e408-1c21-b051-140e62be2cd5
 23 76d79440-4c35-25ea-b5bb-12e2dce156f0
 24 56267141-5d92-0288-bd69-20e59f5c3a13
 25 b46ddbfa-3b20-1f06-82ec-dbcc94e9fbd0
 26 92f53fba-c99d-8cea-917c-fb2469b79f19
 27 f2f0601a-a45c-518c-b838-82bd870ad48e
 28 3d186308-f259-134d-bd95-367639610b28
 29 7e5962b8-299c-2501-a045-a18655f55657
 30 acbdf7ee-bb27-3f96-adbe-8ebcffdf9dc7
 31 19392d89-f580-3fd2-99ef-566931aec124
 32 36d8d7e7-8cd5-42ec-b668-8f44d7285401
 33 00701a51-589c-3184-ab46-ec801477c94d
 34 1e1ee9e8-3352-2391-bf80-890894ef6bc7
 35 eea29072-375d-5847-aa96-0ec017db2ac4
 36 1a1448e4-0860-7034-87ac-c743b0afcf43

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 817151427325212465325120185123343257. Exactly this sequence comes out of new Random(209).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 80 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs