A858DE45F56D9BC9 archive

201303080250 19wh95

explained decrypted filler

seed 615

Metadata

Post ID
19wh95
Title
201303080250 → 2013-03-08 02:50 on A858's clock
Posted (UTC)
2013-03-08 07:50:47
Timezone
UTC−5 · title 02:50 against posted 07:50 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303080250) = d62a963872157010faa58185987f4f66 (name+title)
GUIDs
36
Filler GUID seed
new Random(615).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
251 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8725CD1950CBC34C A5A67650A9754C07 A5407767A961A209 336AF2F644EFF6F4 064BAE201070DE8C 9BCA8D0577111C01 11FED267F06BC2D6 4DD4674A3F237688 D0B3875C0AB8365F 45EC8E9FA8E4C7A7 BB4F2F2474185FDB CE23D9C3850C2BD4 0C6E3A21996BEF80 9591FE105A337A61 B4B0387AA5D0ECEA 75BF30E5A34EB448 925ADB1EA4298AD4 262089DE6FE979B9 E5E8A27108EEF6C9 125B693F605F83A4 55AC3F6A70CEEE5F CB1BCF7E780A72AE 52B38CDEBD049E3E 03673AEBC29E8724 8D3DEB1C8AB36260 35613D52E2996590 EF5284578A1CF98E E9703E66D1B6531D 6022BB4F634492C8 60F8817EA82CCE19 218AD16D3068362D E587802172A012FB 8908121C7C92A887 6B0D0C7CBB274F66 F6DCD51BA95BFF3A 19F63E8286A3856E F822F5AE3A9C8FD2 0B2DCD9ED600DC59 52C2B68F4D63D05B 5B7B21BA51500DEF CA822D111C15FC90 097A15BDD7855102 4CFA3F66838446F4 1373FBDBF39E8C1D 5F0FDF740DA5D51D 8C30FC4EA724DC27 F3938C7982688B59 164CF7D49D275B38 068E157543063945 20E3100FD91BC5AD 3472D448681C4532 CEEE5E6791BBFE2C 863E3E03395C7A9C B9210DC6085BBF6C 057C1D34FB5FEAF9 3D52EDDC9C12CB39 23C463743B4A7D81 7228DD2A9304B935 34EE49DC9C069390 12F24FEB11151A78 C7A7236EC46AB197 E4A52CDD298BC7CF EF8319C5B28CAE72 C2E148658A0D7BF8 682D6BC6585C39DD EDC2BA65B1F2AEE0 49B757105422392B 772EC884EAC626A1 AF5DF09396B81820 81839AB2806AAE35 733BB189A1D4543E B90D877A1C97FB5A CD90829F9BF50370 00804737B8315301 E0E1AC93FF5E474E 16C8BFB8A75F4E4C 368649A6AA29ACF7 6B30AFAA3C99CEFE 71F78C2D8435D6F7 ACB2A9F2EE1B7E09 3E8F2B6EA37F45D6 F47B4B4B5872CCEB 781D7A9F4D50B9E8 C905FD323CE30667 0F6D638342E3BB30 914FDF707C2B421E 5E10265BCD67DF5E 83F7CD485151EB0B A4507508C3863E72 8C97BA94845D28F9 D627E99FA4410156 5A1901F3498BC714 58509FDDAD398F54 54269E4F2FF67119 8331C493658DD82B AEC62DBD17F7167A 61FD842227256FB0 7A6CFF08E4EDE6AD EE01D3904AFC542B FF941539D6A7B799 BD16552AF3A554F4 3FAE24664BFDE1A6 93E23B39B11DA2AF 4C4167021607A283 19C57669DE991020 AAB4B051A729063B F3EFC089DDC42F68 C5C4F6FBF0AA5A55 E548F87FF35664FE E2DCA68CDE451442 27B8A27A395FAF60 4EEF2F6B266548CF 048CBD15524152F1 45C6A7A4FC7677A2 7A8F7143FB7202C5 8A8333551D63366F 9B5E6E3BFADFE9D8 CC7AA5A88219F2E7 50A6188243F278D6 4529AE5396766E1F 6205F7730CEE6999 6ECC7AC1DD110E10 4E152B6CC8405726 393FB47BEDF1EBBC 11D25EB98326B653 C8BAB3E11514C4F9 3F01EF3C9E2D28EF 8EE3F07C9CD5AF28 8FAE86F4B7E4EB41 616236AB0C899A5D 3F92F8160EC0BF8A 5E0923FED7AD6007 978521414650AD99 132B40FA5A9BA6A2 C43AD4620DEAA972 54E271D8E03A6E77 71F7D545B4DBF4C0 92A17744095FEF99 90C69175A1F2E21E 2D6AF67B7CA6039B 77D98B8E09FCD1A3 A94C543614580DAC 90DE833EDA5CF317 0CB7B0BBD0AAFF15 2B3439DF47A1E482
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303080250 (name+title). Key = MD5(password) = d62a963872157010faa58185987f4f66, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 06379510-b27f-09a8-8318-452bce861b4c
  2 0f946a11-fbce-2ecc-8fc2-44f4baa6f253
  3 779e7158-0dd4-5e43-a6a4-cc360882bec5
  4 1f1380f3-d8e4-7ef9-94dc-0d9099cf1bf8
  5 d44137e5-5b61-7550-94b4-95e2974d38e9
  6 7197fe5d-6fd6-0fc7-9af2-bbf24bcd44c6
  7 74439f51-4b3b-42c8-977e-0e7b059628d1
  8 985fd6ca-53bb-8fcd-9edf-801ca3cdb540
  9 1fb38b57-6eb1-0ca5-8b69-8ff67fb4efc6
 10 cc3de4ae-265f-01e6-9106-7d902d5e3466
 11 2e69be76-3439-3bff-b131-2049198aefa8
 12 0e123f0b-0d31-532a-bd41-c0d00c693914
 13 48d77ad1-0051-3a6e-811b-11b5c21efc67
 14 03b622db-f85c-32b9-8584-699fe1ee18aa
 15 46962246-0d79-410b-b3f2-00fd01e8a568
 16 a7f57d26-7fac-0fbd-aecd-af37f9f955a7
 17 d0643e15-f3ad-359a-b7cd-43dfb67bf219
 18 66e31b1c-5a22-2831-91b9-78155d2ae0e3
 19 4058ea91-f05d-24d3-b91f-0b6cfbfda149
 20 6a7d30a1-cb20-43e7-88d4-5b17c234d484
 21 de97fd64-b634-4ff1-9109-3cb2b6522832
 22 c519ceaa-2fe0-6ee3-a583-b1287cc958f9
 23 43c2caa3-b6d1-8d85-8f87-163a43a9be56
 24 5018ffcf-beec-76f6-8f52-2be7c1c544b5
 25 a94a7cdd-8db1-8235-8b18-d67a60f1e393
 26 56af57c4-c047-0427-a9a3-0fed8cfacb36
 27 f771d839-ff05-6289-a824-905287a9e1c5
 28 9cbd9b4b-beda-6ade-a014-0b64f5dc1bcd
 29 6479b66a-6fd0-32b4-886f-c157cfb837f1
 30 858dd9ff-bf56-3789-8018-26c3064b6193
 31 21ff4523-1f63-25c6-9040-e2fd537c69f9
 32 365eb586-b97f-480e-9339-94c8d4be0435
 33 4cafa906-5d19-5ad4-88a9-107dafb30778
 34 c55eec08-d856-3483-b573-95c683ae3c92
 35 fdc459e8-774a-331a-be83-75318f03cccc
 36 5a8c5f91-ad96-3682-9229-e51f1adb1f43

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 025770480035334032244687806633245333. Exactly this sequence comes out of new Random(615).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 251 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs