A858DE45F56D9BC9 archive

201303070132 19tzhm

explained decrypted filler

seed 908

Metadata

Post ID
19tzhm
Title
201303070132 → 2013-03-07 01:32 on A858's clock
Posted (UTC)
2013-03-07 06:32:48
Timezone
UTC−5 · title 01:32 against posted 06:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303070132) = ecf9e8870255128d5f496fce14180777 (name+title)
GUIDs
36
Filler GUID seed
new Random(908).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
228 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1685674CEBDBAD45 E70A0AFAB065421C 48A36FD56F835B9A 6456798053AD3CA5 27218798655D40DE CB3CAE146139CB6A F1C1575EA53D9A86 51FC364654C5C287 C7CD4DBCA216867F 38B642E9B02C2F28 AEC2D1AA58D9075C FC968423BD8F8213 4EE8CB8DB1E7FA74 D42C4BEB288F3EDD 01E4320D916AAE53 9B0257D6241954EF 572CBEC213A4D3FF 8D21575E48D7D835 F475AF03AFAA7B3A 78C34D7F66E28B79 7CAF9170A9E5F137 3BA666FAA1C127CB 43D2642F2BFE7BAD 4551934EF7FA31B3 538E570913837829 6411E72CA8A6E9FB 004951DF2DA5BE5F 83903FE27664931A B55502507C391D64 4C89CBDFE35BFA45 314B40489010D20D 5B08D20BE8DADF32 B9B874FFFDA5F30C 88C922D7FF6464DE 9C034B341C6A3405 A61C454A3FE11656 DF09A917C5E6DCEA 214B48C585925298 09EBE9D51529822D F6AA28E776DB7F21 C7D3FA06F11AED25 13B66882E64A5774 FA771E860FF63312 90CD6F2806ABF37D 6C4EE75435B32896 067F4C92F1AC82FB DC7F145B98DAAD58 F62CCBF78E8A614E 083F702DB76C3864 28F9BACE8B4E4375 6CAF22A87E23B7DD 87CEBACC90E301CE 06C61F8C6C1EE791 B2E27D62E4261077 4821B0A31CB178E3 5518E0399F25528C 8B92E8C5B8216889 04D85AA2811E7239 8E167EEEB888D551 049917F656A73D76 123A61E482D73DAB 1CA4B2B9438DA6A5 80C9BACF7A39369A CF2BAAE3ACEB5854 17F51142264BCD45 58242710413E32A5 C886EE5FD4462241 0C055B3710C5A456 6257AC495AF26FE7 CE6387C148CA067C 4177AF09D6F1F77B 3D9A0A015EE62819 58512F05BC7F25D4 519ADB8BBE174AD1 E2153DAD8A2C3671 3F0204CA1244B57F CD43F48259DE3E03 6C465F6BEDE2344F B1FCB86A3B5215DE 0FA88D26F3C4B1E5 25E10180A115B9D5 BD27537167315AA2 5045576DDB0F0A75 D4C63AB354D37E8F BA3FC5799143A0E2 FAA63E87FC416296 533A146495D6957A 4168C2AAD81EB818 E5A98AEAFFEBCB93 2EB8B5A57B48DC5F A5839856E0605871 474A4BDF658FDF2A 38C2846B1242A89D A182584698447825 4D64453027ACEA1B 545D4A8A74596B99 C53D1A6CBAA02396 A81421475E28D47D 125E6C3DCBA6FF8D 76D929C670523FAA 27A83A183C957489 9F3DFC9C6A9E37A2 D764D2A1B043DD23 B269FACF2BD1A544 C0001195DA2C5410 E8C28415C993B9CD E4128D4FDC234E01 1F36CD2DE79D4E29 854E8F27FA875DC7 E7FA84699A04824A ADB63AA09ACE386D F517C2D46C320FD6 798DE93837ABC708 E77F41F56C1A2842 86D284A9DEE3A0AB FC4C77C38D5299A4 30C5F374DDBBF778 5C6BDA42CFAD6AD5 D5291528EF0DC6D9 91AA02A63A237CC2 777E5139C7C29AF6 18A584B80D652DD8 11029F5173EEBFC9 D8C169C246940902 BF9F890B0EFBC4FA D0224B9F15F8D881 98FFE5C1FEFA7EE9 734BE7E333C99EDB 22120AD6841EDA05 3F79D91E27ED6EA6 B4784E02ADE8F395 60B0F388E3025A47 2A7A56273B55516B 64AF417C7D8DBCAC 4444C03C37B899B9 A1027EB060504F29 5D36DDE121141A8E CD546D40BBDFD39A B999896358C77395 A1934F0D21A02A49 F86DFE761FFFFD78 E14EC5628CEFE203 F050DD60CAA42866 D5CF3100E6489A0C E084B7A2A326DAD5
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303070132 (name+title). Key = MD5(password) = ecf9e8870255128d5f496fce14180777, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 74ce0257-fb21-04c5-a18b-53d410b84c3e
  2 e32a5e60-54c7-201b-8a1a-4de72be2aaca
  3 d5b2f6d6-36ac-48b7-a475-bd8df375569e
  4 8516d381-7651-379d-b5ca-8a0fa7361e03
  5 df253cc4-4cb9-1b79-b37b-10309a4cf71c
  6 e1354607-29e7-0cf0-bb5a-6042fd949467
  7 1e47878d-bf95-6536-a6a8-07426da30227
  8 9a194b8f-91e8-8d67-903c-31105608d7ce
  9 4a1049b7-8efa-2910-ae17-beda677cb0cf
 10 88aca6c0-a2e6-0862-94f5-62ce43c6912e
 11 599a2976-c12e-2904-9396-4e9a7b6cf7bf
 12 85ec7a8c-0822-3ffc-9075-1eed3e4f919f
 13 53b3c80c-17ad-70c4-b043-830e36c6c779
 14 35b9d9b4-3e86-7493-9ab0-39a553ad2039
 15 57a3e4f2-d2e5-55bb-aa80-a8f7f02ebb25
 16 5d6f976d-f071-045e-a13c-9bd096987326
 17 6a7c0015-1346-4699-8634-d8ef30320715
 18 ea8d5601-cc75-8b97-98c8-888eb8b6b296
 19 631f9908-9d71-2279-b180-b13b77d67248
 20 e12b128d-f76a-8104-8596-b412fb2552d4
 21 1e0d0f0c-98ac-4169-9daa-c694e4299ad1
 22 d16bd181-e321-52a6-809e-992c95389797
 23 c9e0ad8a-0071-4f0e-8db0-754e05e9418f
 24 085ff58c-6156-2a73-86fd-28b19e66cee7
 25 98f60579-1726-679a-ae12-6ad9fbee7806
 26 4b3802db-304b-440f-80c2-199eb0beb67c
 27 73272f98-95ce-5583-8ecf-20df68a1b3d6
 28 959c0c93-5184-2e0d-a180-f1f78308bfe4
 29 b1aba5fe-e58c-3ce7-ac82-aa6b8ebd6cf4
 30 cc02072b-05eb-3cf5-9721-0d907f291166
 31 0f980b1c-9849-3a3c-8e23-d8611cff4f37
 32 1119dded-b641-5925-96bd-d5409d239ef1
 33 02e4721a-fe48-30d4-9c6f-ceb085ce57ab
 34 aca04929-b655-6350-a815-4b2ba8b78511
 35 5f369097-0b37-67ef-924a-c9bdcd12a926
 36 f98e1802-c922-10ef-a6c5-f20f453b1190

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 024310682023775048284542645233353661. Exactly this sequence comes out of new Random(908).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 228 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs