A858DE45F56D9BC9 archive

201303061220 19s9jv

explained decrypted filler

seed 535

Metadata

Post ID
19s9jv
Title
201303061220 → 2013-03-06 12:20 on A858's clock
Posted (UTC)
2013-03-06 17:20:48
Timezone
UTC−5 · title 12:20 against posted 17:20 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303061220) = 9d54847e3860f34f4d8d80ba3914c00f (name+title)
GUIDs
36
Filler GUID seed
new Random(535).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
216 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

715DEAEFC02C08F5 E1010158FBA3A936 000D2D2FB0AB0EFC 4D3DF580EA8AB1AD 366BA50842D176E1 D0036B62B3BBD60F 0BEF09EF69445F94 EF720DFF15CD2956 E34F645D64E48ADB 3E199CC86381DE25 CB743BC6916D5DF7 90B31A950EF52584 B4B9CFB7FAEAE005 B9C5D2F253CD47CB 602CD235E31FC3F3 017A779A2798A89F 051735D55785AD7B DE57ABD1CB4FBC12 0F39DAAF472B6F80 10EBFC0C5D9C131C 646BBDDA88B7D786 245DC25DF7495FA7 69A92501803C1B46 1D07A49152EEE4FB E7E48D8DE510F303 28027A642415E417 14873B98F9909689 CA5ABFB0FA99E906 A0F0645700E6D035 C0F4577B842F48BB A2C1A89AF1C89EEF E34D3F5CA0578B2E 19C57E230BD37F60 C7F202BF75E9BDFF D9B0BC3ADADC3DBD 605337048E6538E2 44CAC7A1A40FD6FE C5E86D5D212CF4D9 558657E6E20BAB82 14B6BDE69E58E9D8 46985990B7CC8330 B516BB0BA9395CD4 9B77F28B4D6DBDCB 01071C93C49FBC25 ADE864B25A10F539 A9DBBF70299831B9 721A595CD1DE58A4 154790250ACA8AA2 AE245482542AA710 B2856B763997B192 C6217441F3E91A94 E8F2D5AADD00B71A 5C2F58EEC7407CDB 35C63CCB31475ED5 04C25A3036C7DA7B 0FB2FD3A9FE9F5F1 057A3619AEF7E127 E226B807A4858F17 A3DBE9AA7A7263B5 40BF6E541375FCF4 4EB951C7D6B2B9BD 864EB250BDAE1590 20914B5007F8A082 4FFD16AE15C53A33 62A5F0DB5BCE9A3E 01F54E637191976B B95DBFD421F8D5E7 FB83E2A20AB0EC99 C3032D27025C29C1 0567E1A429A836ED C19E2FB28F5CA0BF C28FA522F709B299 E5835261799D1F04 36E244800056A3BA D1003398E39D0E15 C829DAE1527C0DA4 D41BF042598E2A73 E56986051E5B0F5C 2971DF4E3C9B82D4 DBF7AE9E748C628D 33C03A06C19173EB C3B318898B96B0F0 44D28E4A7FEA06F3 941439B0D0E2FCF4 24E98EA11B0D9D48 B35E1AB6F3D26989 E1BE12BA8DC65B81 4ADC0133F63E1A9C 6AC3D1597A16CD12 A1254B095ADA5993 5F1EFAAD2F172915 A8E37707CAF50DD8 E96FB27836A629B6 5871C519B3F9EE0A 54A9742336EBDB33 EA6EC5B016BC8970 07FB9963812CC1BC 8D039EB9757FD9D9 8AB54CF580761E8F 44484241FF5FAC14 6EC6D4A62C9C1463 A64E0D7E6D52F355 40E7FF3C313947EF 5311BC1BE2DDAA06 4CAEA45B9C5B8D5F 47A0B372B2DA9DCF 429A2FFC680361C9 0B0E5F23338C12CE 0F7AAFD133157340 1DFD293F71E651C3 44BE4C5CE23D0A3B 38E73399F52585AB BC698C16B0223E65 D700A8D7B1799521 9CD54BC30122E969 61F15C9A129719F6 639F984F942DC057 A611E98A4EA2EED3 8132D57CAFFCFD3E 63FB04F3A35A753B ED960FFBFED52A32 B8252562AF3F260B 2190726AB79F1A9C 0D4B7E53D223EABE DB25791A7E010F1E D7797AC2C199AADA 7FE32FD8831E56CC 8724AF5A63F9A58E D58601AA2E589D4D 4F32DFD094A7B243 F5AD60B6EB283A2C 9EEE26A831377354 0BD2313F38B02CD9 C91A56C79B00E633 C3A022A2D5A1FCC3 5E22B3BE8E893893 1D9A6DA0ED9D8C9B 877D5FE236D22931 F442FF076828D7E6 E026324755175CDD 631826D31F1989FC 594EFC10A2674A32 E2354CA362242671 DDA4638413CBAA3D 8ED7E99BA4DAB171
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303061220 (name+title). Key = MD5(password) = 9d54847e3860f34f4d8d80ba3914c00f, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c83826ae-9d5b-2b44-a3e4-edab665d0730
  2 1ff8f388-059f-71e1-8ff9-345ca771eccc
  3 9ffcdff6-42df-6345-ba3d-0e80d2fc23bc
  4 a86b30ec-eb7e-64c0-8704-c2ff8a4b1ebd
  5 41e2bab9-4871-6df1-8ca7-f962502f9565
  6 e34cacba-6047-0625-8522-e08531bb81a7
  7 a43b97e3-3474-500d-b04e-f3996c1d5647
  8 ef546bc0-b4d3-765d-bcf2-e1712af63a14
  9 2ee52437-a36c-1ac9-b0ac-ed76a15d94ef
 10 c13f9e83-cee0-4d39-b6fa-3bdab83992f7
 11 833f42dc-ffd1-3617-85ec-903c2147b7b1
 12 b72a0cea-84c1-1c6a-92e3-ad25760badfa
 13 d9ac2433-023f-3bfa-9810-43865485b9dd
 14 6bddb6f8-1eeb-7de2-8efd-a61f9f079492
 15 3ec1ffe0-4be7-4d9e-bf36-245b35ff38dd
 16 d29fa587-5cd7-121c-8b64-e177c749e130
 17 46365fba-cb2c-6d2f-a3e0-429a07e3565f
 18 9b0f377d-876d-6203-a375-c96be3c29fb7
 19 989ff0b5-fcfa-1aa5-9e13-adbdb52b2d44
 20 fe596155-ecf4-4213-be0f-c864576954de
 21 b837d06c-b23c-81a4-bf1b-8281f19aa5d9
 22 09bf3524-8cbd-052e-8c0e-44fdf28cc2f8
 23 68d61ab1-7de3-3a2f-9ce9-7de884e24eae
 24 57460305-8127-88c1-b4aa-537cf6d45994
 25 d3235131-7187-1fc8-9c4b-fbb806c633b7
 26 680a70e3-c9cc-5176-8ae1-878198aab6ae
 27 41f853c3-6b2c-8ae2-98fa-cfcced3a9fd0
 28 8d7f2710-01cd-1dc4-a722-20222c6a0568
 29 579c4752-b62a-2f85-99cf-9f73ffea8a42
 30 d9fcb7ba-3b8b-819a-a8a9-68e4352e1aa6
 31 90710ab5-e08c-6515-ab00-83a2d4d8fefd
 32 bedc849f-ebe5-397c-9343-fb364713cfa6
 33 0b499ea7-035c-3dfe-bb18-8f43a80df6a5
 34 f97bc820-5050-32fd-899f-79abcd238091
 35 fcef9e70-edca-4bab-9ee6-6445453aee5e
 36 cdfd81d9-de5e-8488-94de-36d48469b818

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 276660571431374166148038158128633348. Exactly this sequence comes out of new Random(535).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 216 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs