A858DE45F56D9BC9 archive

201303040732 19mvam

explained decrypted filler

seed 170

Metadata

Post ID
19mvam
Title
201303040732 → 2013-03-04 07:32 on A858's clock
Posted (UTC)
2013-03-04 12:32:51
Timezone
UTC−5 · title 07:32 against posted 12:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303040732) = 76d14e5b3b4df154c58b3b5263b59c96 (name+title)
GUIDs
32
Filler GUID seed
new Random(170).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
168 · predicted N = 32 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

23726AFD6F64B1A3 6CFC2EA0BF4BA237 C9908516478ED579 F35CAC53F41219D2 FE638768C449A304 C6F723713C02AF4E 221762E447DB3C5B 65734D5FACB5226E D274360AE07AEA20 87F9CDF467F7E9C5 43C13795C7A8C662 6698FB666D7AEE63 5130FC06550EC989 F73D07B5994ACCB1 8E8E527337311E96 B2064FE4355359D4 58CEDC8825313065 940B6E6822DEBF5B AE4981E3E88C272F C5AAB60F1161005B F011D92C03C93A6F 263B472482009C1B 195D4A47A7661C14 F6B4B7B929638033 0AE28E4979BA5444 52D3C591E3715F64 40556BC545F8B04C D639394B8A521FF7 4E878901B739B058 530CAF8C82EEB737 7863BC7960837041 B12B08AAFA832419 61A2F232CBEC26B2 F900D663CDAE1AE0 AEA712B0A3836E66 84358389DB78F56D 926B86D0D40A728D F2B2F38CC5448276 5031E798B4C118A9 A5DD114D4BF1243F 75628F504C9E6C0E D40B2DC048741D6D 2AD63A39F2BE681B 8241B79699E31AF4 80299A65A6430776 83097F49BE21501D 0CBC64A4513D5FD8 AF95BF9E7B9C3F87 C42D6143F74C592A E05CCC212B633512 D88D9C3265A73554 7CE155A9978F5C2F 381AE83D79BF86A8 C1EA80A8F85C6D40 58105901986AA57B 7771F5B2C3A795C6 CBD1A92CAEFA3EAF B8B77253CD0411ED 42BC660CD4D8ED6B 6181CCA1781F6860 6A967F8FE4F2055E 2806492285EB702D 7199220AE9EA56AF F99040D96E63592B 3F91DA7C728AF4B0 328AF2A1BFF3C639 DDAA05CE12D217F5 8C04EDBB4B4AD561 073D2E9C9857CD24 E3FBC4C40E941BB5 2D63A3FF3FDE7F97 92E1B18DFCAC7070 EB12DEDA6DEFE1F9 5C0FD75172D22BD2 3EA90FC48F73D5DC DF28F8911C18A0A3 097B95C32668EAF1 A4A23150BD971B66 2AEC0FE26CC97605 486F847D126EAB0F 2257072A2511CA49 B7F062AD4F675820 2A40E6300D89B4B5 BC4C0E6A5F1B2CC5 D58C750EC6D1940A 0874B05097702FD3 EFE1BECA13894182 7D24878042B18FD5 224B0AECDF6EE7B3 61F8D08D65FC91B0 7D5DC2A0DA02D933 A636FC61D1EFA59C BAFA233C4220E767 DACAE3D928CCB1EC 1A022542A79586FA 438B0A80B0FD26E7 108F4254D0163C64 DA93CE1D43DEFC97 6D1873826DC31159 F0F1BA086AFD752A 3D30D0DC19AAFCB9 74F4FC550652A068 59C7D2EDCC1EC6AE 1083F4E5DEB54F76 8F664C82BD4BF2B2 575CF02D773FC666 AD6386267A961E1A 432DF1DC6FC0F7C9 037514C5E5EF278A B6F4BE0474780211 EEF61FECFD9F0CB4 FA967B350B8634AD D0341B9237D31185 0A2999B933900170 B082179CE4AD235A 45F71082F3437F60 10DE2B3C58F805B7 1B9631C469DC3C24 E72C1E841167B095 FB2A10CF3FF1572C 87EF76E1540EB7F2 EFD496072D348948 F5FB340017029ADB 6C3ACF75274D4016 E3A03D942FBF010B 5283E244F5D2AE26 E62ABCCF3FE2A8F9 1C2694B4880C1B53 F6059A25E9C95CA9
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303040732 (name+title). Key = MD5(password) = 76d14e5b3b4df154c58b3b5263b59c96, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e549aa46-119a-484a-b5ae-0cf9576ff41f
  2 97179dd2-3471-67bb-942c-bef7f502c02b
  3 e0d17f75-4f00-563a-8779-dd94ae96ef59
  4 88b19900-31f4-71f1-bf60-0c2c382d070d
  5 105d554a-1a19-84da-b7d2-2ebc9f161586
  6 425466d4-ce7b-14c2-948f-8c0603f33dfc
  7 9c95ccb0-52d7-0ab9-82bc-db0949a59d96
  8 87f86a7b-c564-683e-8068-9bce9b462553
  9 3bcf9d0f-cfd5-00ba-a3dc-88bcfcd05ee1
 10 67d287a5-d917-8140-9785-a85011c3ca7e
 11 1cafe88c-7000-4800-8510-67fffc8df8c7
 12 58a737cc-3eea-1459-8199-4ca15b5be56a
 13 135f7ab9-3550-4450-b016-483bce0ae18c
 14 d58b2e54-d98a-8515-b190-a5fa25a7b2c0
 15 01f8d3ee-133c-8216-b4a8-bdbef9ce4607
 16 5fa8a357-2652-1f17-850c-b64dce434cad
 17 b7dd1e5f-03d3-23b2-bf13-dc07c61e9694
 18 a54a0218-265f-3311-9937-ec75bcc33366
 19 bb19366e-d500-2bb0-88da-f9de021aec0e
 20 b31efeda-a473-18cf-9786-851f2e89d56e
 21 867342df-fe4f-3f55-a447-714610fc6cf4
 22 1e1a4d6c-7c48-47d7-b3a2-09f0e7782f24
 23 c3d243d7-ce71-616b-a6be-b5afbc8ef0c2
 24 9f4ec05e-524b-3e89-bd35-fabf4114fd51
 25 9d111aad-f3de-30f8-b6d6-834399052f6f
 26 937592ec-cb80-7fa9-bb03-3e9ed57d9cad
 27 1c4cb118-6f49-00b5-9c6d-bbfe7422bc92
 28 0553432f-2d02-0892-87af-db0a26239aab
 29 132be96d-5c14-4509-ad8e-546cc7200f08
 30 40fb54b2-8e38-8cae-95a4-d39da6fd2197
 31 77544bd9-42bb-806f-abab-c3831b28dee1
 32 e69e02c5-af32-278e-8b24-cae1392d7090

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 46578106084148812321346337004882. Exactly this sequence comes out of new Random(170).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 168 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs