A858DE45F56D9BC9 archive

201303070026 19tvgi

explained decrypted filler

seed 955

Metadata

Post ID
19tvgi
Title
201303070026 → 2013-03-07 00:26 on A858's clock
Posted (UTC)
2013-03-07 05:26:48
Timezone
UTC−5 · title 00:26 against posted 05:26 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303070026) = 17fc37abaafa4b7e8acc7ba8c6bb9a43 (name+title)
GUIDs
36
Filler GUID seed
new Random(955).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
227 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

BB1C6C916376ADB6 5B92916230C09F02 67394D6220952291 DE6C5B8E501C9933 AC52793504FFB4EF 7D9FBA15B1AF5B05 2617B57BF3CC4988 D29DE23B835E15FD 3ED3C382C57E5CC8 65CB17CBA616C913 51B7C818795A80C2 597FCA7F51E0F4B8 BF10A0FA1898FB05 A6C863006E4C5CB1 D10EFBCC71F1D581 51C428BE4048CA37 EF098AC50CD9D0E4 A55265DB1A25D723 D51B151C8984B8B8 5252ABD62141ECE8 11B33EFC0C20D447 B67BBE19B522D95E CF15B8D2F43810F4 390BF5B9B9412D2B 92B0B92B98D32DAB D536C2917CDA1877 DFF2ECB6FD7B8DF8 4AC6FC2AD7D19BF9 F47CCB10203A123A F34CE1F572147138 18615A5A675D293F 0DD3734DC0E1A55F BA889E82451D1172 3BC341A4C3B93C1E 97F8A23869B901A5 55941DCD2180EC15 92A3AE8CE70E05D3 58E9EB8C124E63E2 439458D35F7A9747 BD90A5F28D8694BB 56491B46B76F5AD2 98DC26E299C31043 65AA5ED3E9831E03 4BB34FE215EBE5D8 78EC3ECE7DBB756D 9C1219DF27AC547E D8EA5F0EAA1D7DB6 EE380780B674DD59 A725A58F6212DA7A 7613E73BFC520C55 45F9455E691DF1AA 7B7ADB781F66F793 B2F4952D1AF0D67D E7F1D35622832DC3 024BA35056EC68E2 BBEC4DD45E9B7FB5 9AC0576A6783AE9F C69E255FCE11C3BB 361CB8D112B10121 10552736BB3EA0D6 60A8BB1512B76FEE 64683DB7601C2EC8 CD28F2BC9BD89020 478514D61084B3B2 516B0A53E535C080 2B2E680C25673C29 9848F17F15CAC5FE 5240E4CF8193666D 7C4EECA0AE4E45CD 23467135A28A8DFD C63698360901DB17 F85A3CD550C5DA76 8D5A37C23B74FFEB E101E2ACF8590D81 B81A4B8FC0E8CA97 73E4FB2F59A56905 BB50EFFB0F934286 74E3DA526905216F 3C0CE16099146C47 39FB7CB19770EE35 A08F3C6AE4F52C20 26841A4A4BFC51CB BDFD19FF1D85F909 09AB536B3BE5E3DF 4D08E43CBF4260CF 58BC702EC305A0BD 9F668BC27A531607 C5156557047BD397 60F46CA76E052E6E 4D1999D0CCC75113 F71C225820DD9D6A 3B790D7C81D3BCF0 162DF365AF96B4B3 E367DA4F574565A2 E5312F1AEDC74316 1EDD7B0061480866 68F5164DA0989DAB 9822AB68CEC9F714 DCFA495934771412 26791947908B533A 450DAFEB82BEFA7E 9D1E9C6FCCE8F35B 1E1B35BC9F4F5B43 141F8B1E9A6CD869 0CE622D835D857BA 73B841D51C51087D 0EE5153B1F1B4B55 999504247E617ABB 1650064E368F6AF3 983D9284569D4717 B6C67FFEF7F128B7 4AA6A39EAAA88A64 F0ED961C719756AC D8FCD18DFABDF206 5DEEF03136C83508 0A9740A583445B1F 003FE3C374891C5B 3F408F12089A523F ACD14A3CDCE6C914 ED10E06F09F42FF2 446A80308026783C 3FE9178EFCE1596D C22A00E3E76A4687 1560BA78A428B8D8 96502986E2A362D1 6A9F90E3C763434C F36E233A2E2EDE52 C3CE70114CFBD68F CC288548F313C84A AAA99906781FA2FE 42CBC037B6F31CD0 CBE588AE86FCF190 2B784310F3E2BEE4 2AA6B0F14CED04A8 FA55DBF2C553D010 9B1C1FC048CDB342 E0DFFE660CE3799D 3722D946ABFB0277 E9F09F4AD07D5A50 AA3B37577909B040 B0AAA2FCD3A47C21 18DEE9963CE1685B 8212D99165DDA3A6 2FEDDFA279D9E7B0 CF0A7EDB65F7E6AC
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303070026 (name+title). Key = MD5(password) = 17fc37abaafa4b7e8acc7ba8c6bb9a43, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3d9ca9de-da5c-5eb4-8ff4-9ce1f615ec31
  2 820add92-9a18-08f6-853a-7df13e4b30d8
  3 eb003936-9ba2-2565-9247-89abfa7a45ca
  4 6b44211d-845f-3018-8fbe-bbefefdc131d
  5 a323302b-90ac-3fd2-a79b-6c15ef4fab48
  6 312fa046-75fb-1814-b653-e4c3907a894c
  7 4d13a618-d0b4-7c37-b407-5f031b41ed21
  8 bf47e553-ed37-42f8-a505-67c12e9a14c8
  9 ca498714-fc9b-1c3b-a30d-61c335dfedf7
 10 c1c75a44-6cc0-37e1-9739-73e09b57bed3
 11 de47d8dc-2b13-7ecf-b0b6-7d26054f49b5
 12 d9e64125-f9d6-0fba-b376-258ffa21dab7
 13 2541fcdd-5231-1720-84c3-3a16e778746d
 14 9174d5ce-37be-2960-9d86-f8afa107cea5
 15 88ca3b87-f104-4b85-b9a5-851176ffd183
 16 f1db7b55-19f4-48ee-9bcb-36b02c65f5e0
 17 1eee8fe3-5e5d-22f7-a5f3-e3c2e2e4a82d
 18 ed7d717c-65d1-0a97-b389-af3fd409e35c
 19 423eb8d1-1320-43e3-97dd-26d87ac47e69
 20 9f5e9d89-f854-0f95-b4ef-dc1051754017
 21 2d5e619a-dbb2-673d-bc4a-370ad7648354
 22 348ceced-513f-17a4-93f8-47e2e58efa5f
 23 885eb9c9-490c-3ab7-80cb-c6d5042d7ce9
 24 d7c3fe3f-ce58-5666-867e-8c33600c656b
 25 84a0cfb3-6466-2f32-a2fe-98b8fa4094d4
 26 739ac882-d083-614b-9c2c-c168b70dbe2d
 27 c7cba61f-734c-0735-9bc8-4ea5f7d1aa84
 28 2e2bbfc4-a48d-3637-9dda-4525a79b01a6
 29 40bd022a-dfff-23d2-90fa-8eea8ad914e9
 30 036811ba-2a1d-1f6e-8d27-b0cf77d5c0df
 31 634dcd1c-09af-6a17-bf36-2ff6fe063c3b
 32 80a0bbb4-d09d-0fe0-b721-83e0d79ae981
 33 f22aa22c-5a71-235b-917e-43c0232c074b
 34 7ace21a6-becf-8e33-902d-b192fcff5a33
 35 2925d07b-8532-0740-b2b5-3c0834d08c96
 36 2a4a153c-87a0-1439-8e15-9af34959c543

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 502331741370124420406135260321602801. Exactly this sequence comes out of new Random(955).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 227 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs