A858DE45F56D9BC9 archive

201303081032 19wyj4

explained decrypted filler

seed 258

Metadata

Post ID
19wyj4
Title
201303081032 → 2013-03-08 10:32 on A858's clock
Posted (UTC)
2013-03-08 15:32:46
Timezone
UTC−5 · title 10:32 against posted 15:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303081032) = f901a1345312d11c449bbb2898c607ef (name+title)
GUIDs
36
Filler GUID seed
new Random(258).Next(9) ✓ verified
Run
Run 42 (seed 983,934,859) (seed)
Draw
258 · predicted N = 36 ✓
Machine boot
2013-02-13 10:26–11:32 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FBADA130306EEDC7 7607EBFA0FBFA2FC 157DF3E748D5DF5A 71E27E731140C2AE 45AC6FE3940740B0 2DCE77DD1699FA01 FB6177FD8D963AE2 23EC4E4B737F63F4 E1609AB010625328 33E9CB865B260DB2 3C1D08F86050089D C7594712D7D799A2 D42B5BF05A1CC3ED 76A7B57E246A3638 0F8E1DC660466E43 6877C52A18F0B845 701029DE0E8CBB4A E98CEA773EEDA4DD 29FBBDB068FACD8A 6922EBF6A7C4DD6D 7FB5A7C608776D9E 03B5CFB9A8E695D8 69251B1B72CF70EE BEBF46A163556C2A 593814C3670B6887 BDC02C6AFCDA2A7A 0650979CFD9C55BB 34EC2B9BA25EF497 3052F9ED1D4B145A 76790F51C834E0E5 2CC390E2D74CA589 A9227DEBE32FB8EC A938BD668F6D920C 8A47CC78448381DA 47509A776BDDD4B8 1180CF9D039533E2 8DFBB1B836F6A5BD 30D0563E2F774755 C461ACA9A2514BFA C925EC18EA310A69 E80B8B74706C9F8E 6FD4B2E5B56AE865 0CFAB7C576B062FD 32FA9CD197371C74 BAC4538546B9EB4D 94F532B4D110A837 653B10A46DF4DC25 55526CED58064000 7B19CFD9A407CF87 B2E31C26C52F959A CCCDCC52A8BE17A2 462664DED9B85DE1 97264703EAC32A1D B7E5427C8D902062 C3F8FCDAE5E26D80 23E06D52D3497263 19C7E801D454EF08 26A838E8535CA50F F1E8A14799B1F87F 0D24BF8C678FCC6F B6E5EF3A6D640E73 786D7764E40735C1 71A44DE6226C4559 80B28E516C0A0D38 3616E8F2624D75A1 06A4A3C4CA0D0CD8 4F41A7EA6280CC2E A21DC159732BE933 4ED44FB2166AD7DD 8E1A008C529B4C89 C51BFA6C5A23AA46 D1AB1AE33A35F6D0 8CCC984CDF519394 5CBFAE42C5F1DC5F 114824B723260390 C8AD58F016E0B8CD D556554FB493DD3A E0EED74B2B29C79F 3DEFD875CE3F606C 17540C1EC50BE655 FBB2FE050686F271 455EE578767ABA7E 357E47C3D17D09EF BE32532E883FF5C3 E7818CE9BA51CE5F 21BA551E57A51F2A B6B551B6CA2A1504 5EA90A54B874A75F D4E44A60A76B98A1 444637E125C59B0C 198F3F520A2DC1B4 B568ABB08205ED54 46F2538D416FB125 E262DDB962D7FBA3 561C718C2D8787ED 62E4E417DBBE7AA6 063E417BFB5FD580 291DC6CC7075BE63 90965FF34D906AB2 1FFAB270FBCFAB26 5EF73D58DA3C4597 ADA8527FA3C113DB 2B29187E40A5964B 815B8A025E42BBD6 5ABC8EAAC5FA6308 EC1005F2F790752A 5A0B3E4C5C999B9E 69430A66B7CCC33A 142238F55E3CFD05 5E5CD8EF900EC343 E8B14947A35081D8 DADF3973B61920DE 81AA26051330121B F7C8B2E99C9A1D58 F4709027C888B17E 76F25E9B7FE54FE3 ACCA6CE47A81EFA5 A11E7A03EB6FA444 1408E39BFB98B164 841586C49B92AE12 33DE4D2EBB6C8116 391235EAA06C7BFA 4C33BA8F11B107B3 15B71AF1859A2E86 ACB1AFFC61BF1DC0 2F5F45349AE3DA88 5F955B3514AF5E50 70A3D6E76A7FAEF5 83DBE3738DBB7A3C CAB14519FD24CE46 FCEC7F14C2317765 E9E67BFDF18AB02F E8DDC21E748EE92E DA0D1CEB8A9E17E0 35689F0584FAEE77 A01FA5FF17B4D010 8E5EBA5D27C67BC4 3E8DD81BDD321584 1096633FCCF55823 577B102F80A26FCE BDEC14C3E5DD10CF 499E644C74D943E8 1E37D7A32E4903C2 B9B598C5DFAD44F1 4624299EC44756E4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303081032 (name+title). Key = MD5(password) = f901a1345312d11c449bbb2898c607ef, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cc21f98f-ae55-43a1-8394-9f41dfe2b57e
  2 2f4fb780-be53-4e11-a3fe-867323e4d103
  3 7bfe603e-3e24-0bb8-8b5b-1fb656e18b39
  4 f8801716-f0f0-5c90-9c36-2523cb02b8ee
  5 9b8505ad-9c03-692f-b3c9-571d622a9e23
  6 eb14793c-6000-0ae8-b2f3-493a5b75e8f3
  7 925d5098-17d6-496d-a28e-5b0b9a88be5b
  8 ab13f794-a8f2-7cd3-a2c0-5a2b1afe640f
  9 ffdc70d5-b4b1-815d-9116-eeed4502e487
 10 0854c92f-bd7c-327c-9d56-3cb26cd023ba
 11 54fc991c-0595-39c4-8d18-8fac64065189
 12 b73d1b79-c817-8131-b60d-63e280324950
 13 08c9b36d-cbd7-8955-9827-db6ec5e1ce4a
 14 9e0e704a-e5c9-6c2d-a3de-14c3f2be1be3
 15 153e9926-b995-5641-bd8b-3781dfc3735d
 16 1cd13391-ef45-1ccf-8c7b-826c2539bb27
 17 2186b0e5-f2f2-2bce-89ac-481af613bdc1
 18 d2a22f77-10e8-826f-ae37-672f2c8911e5
 19 9250ea0c-8bf2-5c47-85b9-6d146a97ee76
 20 b191f7b3-9217-13f2-ace4-d9adf758c5fc
 21 6256e348-446e-06ee-9188-fcf9d9356b37
 22 f0d98a02-58c4-1ee5-a620-a19434b60cd2
 23 f05ddb1d-c678-5626-a72f-a32821af1be8
 24 02992b83-c614-1281-870e-cbd2548d89ee
 25 df198d8e-8d39-822a-a9a9-1e375e7b0f00
 26 e91d80ff-9cfb-4c33-8ad0-3cca863fb868
 27 df64bdc5-9ff6-63e0-a15b-f511bc86dc82
 28 f481df6e-e023-481d-8452-26943cebad81
 29 da53f311-e5e3-7838-a495-5bf0cd526d49
 30 6a0754df-c9ac-7d25-bba3-00ae299f73cb
 31 3dc87c11-789c-39f7-ae53-25b1619ca8d2
 32 d0d707d4-848a-39a1-8cae-d9f6424ec5e4
 33 c6f956ac-16b8-0578-9d3a-e8045c395785
 34 9061803f-2038-4937-8d5b-754a65a32a6f
 35 55f78118-5c58-6de0-a0a3-af99691a4a2d
 36 74b9b9d4-b83c-800f-9358-e41267aa5e56

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 440560478338865128510151846477330468. Exactly this sequence comes out of new Random(258).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 258 of Run 42 (seed 983,934,859): new Random(983934859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-02-13 10:26–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs