A858DE45F56D9BC9 archive

201303030150 19kemk

explained decrypted filler

seed 739

Metadata

Post ID
19kemk
Title
201303030150 → 2013-03-03 01:50 on A858's clock
Posted (UTC)
2013-03-03 06:50:53
Timezone
UTC−5 · title 01:50 against posted 06:50 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303030150) = a64fc393136df8cb02212f58eb0f4489 (name+title)
GUIDs
36
Filler GUID seed
new Random(739).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
141 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AA4180368007A19E 536EAF55AE1C934B 4E972650575A6087 2AE7F82D55EBD80E F56DE67AB1CC00EF 95943833F4B0495B 94FB9F9F5F4468D8 1E2FA5A0407E805F 8B6D7177BCD549B6 0CCD416D2707338E 5D13B2BBA5503E2D 27CF8357AAEB5888 65554A51D4C72398 53968256FE3CC281 A123A497A4E45E61 A60F4DE09F5E14C6 AA316549A694B161 C2F71AE458B9F4A3 2EC0790E82A149B2 12098B926335640C EF3F17064F681F3A F76698B0895CF17B FD9D0C9954C649C7 91765E0B013F6C56 DBF87E7E310A4BDB 2F4200E5D5A6EDBB 9A5B4558E937950A 2EFDF28B13FE93BF E4096D9691F3329A EEC43B7584CD40DF AAA3DCBC0C5EE0E6 8E7EC502043DCFD0 20E9D3F3C5922F88 38B35F5FF260E1A5 053DD36BEE5A5E15 224CA900DCFF8CD9 EDF9550BBBD85922 A61D506E2F811F4F 1287A3000FE3A1E8 A02323D25282648C 2FFD83CD2A339C11 02624DD38D06E7DB 62C8B4EF07BA29F9 67289B57592E70FF AFB887580937AAAB 6F1616DBDFC0F625 B2C983B1AF63A9D3 4C80BF1C6E90073F B02F805689295C29 198372E8801C1A3A AB31CE9252788FB7 737B53B82C6CBBBE 117715061A13D325 4E9E8167127340AD 15B389C951BEF1B1 6AD67670DB483427 D41D97055595BEE2 BEDBD5E610310D16 4D0733BC5D8437B0 811FD5B43D35B6D9 5E24EEE92D342884 B94E959AD188EE8D 89637DD4D0FA966E CA7F59574E312165 375E456795ADF80F E96BC4E795CF2131 D4EBB81AB4CD082D 90386C607C3EA005 09A00B5241231B5E 0E9A21D314205CC8 ACDD3CAD35F956D0 774F57814FC822ED D53ECA1CC35CFA82 615F3BE959C42E10 08D3554CB7FDB4D3 C920654C1A19FCF8 7641291AC07513FF 397518E6E2B46FA5 F6F16B89678AF03A AA5F12DD6CF01156 4E3B4123215E72A0 D790EA81948F8FA0 1BDDEC581BCD8EE8 9361C282F84A673D 624A0783255C9529 4CD8EADF32D22894 7D1EC2C327C72BED 87E1F9805A46F3F3 56EF4A25DBA3C3FD D51AF220E47C60B7 C87F0276422847CB BE89201C8BDB9F38 FD47A6A71177CB02 662C24806ED4C435 95B1697B69460BD0 9D784D4F18E4ADB2 BE64323854346278 84AC79429BB61867 E5152062B0FEE51C CFBAA3E61409CC86 DE228B17B6561B7C F2B7E27B332D6FED DA79928C57A84BCF 17833B2A8517F0B9 FCED3F48A0CC81CE 139BB81717EFCF79 C0035F37D837A118 81E49F52553DC607 5181790EEA5EA9A3 65B89B6442973F10 C46B03A60948E938 525BD22854A5200C 912FEA047EB18DED 5BBD7988AE9659B0 C0BC106E785FEE96 75C5E2CDC071853C BE175377FFF05147 A6014897B6EBAECD CE0E4E94BC2F8C8D 26987D688B3C9753 BFC0E0CA04512B39 4E46F289DD8DF21F BC1AC1F9A8720EAE D517C8A9228744B3 C1719F56F7DB710C 297DC1DE03A96FE9 D3ECAC957940F73C ADCA6DFE561BCDA1 3862008CBFBC8C42 57DB298ABC21EFB9 F37B864455382321 554EFC9342A4A4F3 23998B7243147F86 DFC6CBE858FF0C23 8FB0960839650AEB 61B3A97108FCC09C 309AF737772E3B20 E62FD6CB1A20E629 246E800CDCBB36DB E75D9BE998F41713 7DC123A07A7C535B A6F50007C4CAC9DF 4C7C70C6BBB1FECA 84CE4807835F6E98 6A1F8C1E775765D3
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303030150 (name+title). Key = MD5(password) = a64fc393136df8cb02212f58eb0f4489, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 18e42656-51af-7476-ba61-0315c16445a1
  2 9f1f9c5c-ff72-5924-a608-2ba8285db2eb
  3 8b48d6e5-d7c0-2963-801e-324042d2798b
  4 f1254a2b-e15e-2a33-b511-861f9e141b3f
  5 53b703d0-9001-7790-836a-4a15fb22c6e4
  6 bb87b840-c6a9-392b-a92b-49a5690b2468
  7 80935a1b-1754-0ece-beed-4722740def42
  8 2948b48b-625e-1802-9038-959726692993
  9 03730d22-c8e9-3272-b29f-66da3eb0ed78
 10 dfdb54ba-1705-788f-a1c3-a18d2c5c314f
 11 95471f04-f8ea-6306-8cf6-8f3e93d0627b
 12 c81807ce-5661-3176-a9e5-9f914043a23f
 13 b17540aa-d8a2-5a8a-a076-da3222bec71f
 14 f74f2b56-0538-8066-b661-8cb0e9388035
 15 b808c7e1-a0a0-2e82-bd4e-ba7c4a12f41f
 16 0ef27277-8730-48eb-8389-b84818a2492a
 17 1ce2223e-7895-44a5-bee9-63e2f603abc2
 18 7a8b820b-4d19-135d-8f16-f6f586d00eae
 19 3316ee3b-5101-6493-9c5f-b1b71999a9c6
 20 a615623f-5675-4e1b-a3dd-474089cc8e2c
 21 e3dc8ec2-8d4c-0ac5-aa98-ea9b26f8fb34
 22 71f81cef-de6e-127c-a5fb-390977db0125
 23 6911031f-9b5c-785e-8780-49479868b067
 24 f1f0d197-df62-18b9-884a-06e693582a1c
 25 07053c7c-2b59-10ce-93de-57617bdd71bb
 26 b7aefd74-7a73-7692-8e68-1b12953f2736
 27 c917c6bb-d7fe-249e-a37d-8cbf1414421b
 28 214bfcd8-36e8-50de-8e7d-96457329a1a1
 29 90e2d414-d453-625b-98cc-f8168465bc44
 30 f0ab8443-7d42-2442-bcf8-b49ab34da0f1
 31 9c0e9ce4-3a5b-052d-9125-0f777f6f31d1
 32 ebff495d-1f6f-0bdf-ab31-b8f109061610
 33 a149e16c-701f-4acd-8c20-4e276b7ec524
 34 c85dc495-0408-4caf-849e-8703e79cee87
 35 c0746674-d0ae-6463-983d-6babf76c09e2
 36 74e5fe8a-3ebe-76fb-b1fb-7eefe648e4e0

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 752273013763582441640171172562004467. Exactly this sequence comes out of new Random(739).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 141 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs