A858DE45F56D9BC9 archive

201303230559 1athly

explained decrypted filler

seed 994

Metadata

Post ID
1athly
Title
201303230559 → 2013-03-23 05:59 on A858's clock
Posted (UTC)
2013-03-22 20:00:00
Timezone
UTC+10 · title 05:59 against posted 20:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303230559) = e0c7dadd391fea142e0f929db80b643e (name+title)
GUIDs
32
Filler GUID seed
new Random(994).Next(9) ✓ verified
Run
Run 43 (seed 120,022,078) (seed)
Draw
1 · predicted N = 32 ✓
Machine boot
2013-03-21 09:44–10:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
10 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F9829DBE459F7852 9DD6E51E372D1BA5 C8C36C260FD6E9D9 C5AA7CE7D650C121 F0AE926328181E8B 2DEFCB4D9CBADF51 B7D0411861D59A0B A9E20F0FB5D6E6CA 42A742F314156999 E9363B0846D3F2FB A1ACA99F40DF75AC 320D1FF4166234AF C842438C9C8C8A10 1D824690F73BEB59 7291D4538198590E AE8B267F5544B0A8 D8CD335323622FAB B18CC0F1B94DA343 079C5605110A942B 2361036D79BB3580 0B7B5AC493650B18 33C3CE0C94961EF2 3FBB525FE6A972DE E9DD1E2E13ADFD58 75612E700F77CF0F 025C9368157D5621 C481475EC5D5B5C0 B0ABCE2E20D08274 4352074B1D02231E E2BE7F68B209148A 86EC80E29A256A3E 0F987A9625FE67C2 A4ED29EED1012EDD DC67CF9AD52FD2B0 989BFDEC17017A01 3B7E567156ACDF92 34E38F660594A6A1 7B14004A7E8794F4 F993A30DF98A7620 CDC02017C4CCDE4F B955B624C3121A6A F7A355C09901EACD B2963456CFBF0594 86B2EC306D68FFEF F250FFC261F92E9A 0C75DAAAF5906B12 51DDA4E46AB0FDF6 3038496980FA22BF 6EE6E3B34F6044B4 EE20F5894C943A0C 9DD939718713976A 0DC0E5506C546D3B 7EFA0CB5DCF43FCC 0DAAF9D7AD1CBFAB 40CCCD853421AEDA C4F3758615713199 F1B81D89F95A3291 F7811D58E8532AC5 4AF98E4C6D35CAD9 D5ECDA2A8162AA21 83B03D942D381989 A3F59635979608D6 A3546DCA280A08B8 B95438DB1B1BA8C9 75017EB5C70904AE 2AFF79F76B20D554 A3DD09C1A150E951 67D1C11436ECEE06 CCB1B9355B049936 C7C8FE4342162636 B9D6B22107B26EFF 276E05E659DD180D 0FD97D4374053AB2 41975CA28362A1D7 06869B8B855BDA67 B6B0C12F69F0BFF8 DE843C879CAAD960 44C708E2BED65263 77BA1F7287524AA2 86A6BDFB444ED73F 773615647643D7F1 55DE17F080FC2CCE 8B9180A04BDF1177 D2A07860D51CFA83 41E123AB56F13078 8A1F7C019D9849DD B6A2CD6B2D0AAC30 A75E0D48AAD9E63B E53596DD0DFC85D3 D14FFA463E587031 9E59962E5BE7D8AD 2F654EF05D743051 8A241A6AB40320BD 0E55423CC6A11392 A7E349BEAF512F18 B483CC74A0BE6DF6 175AC0C1630985E8 7A7E312BD32C7848 4335CAE7110B69FA B80807E88FF3BFC6 D1A73BF4104C29A7 860EFDA6B9E04831 461EAC76DD50FABD BE69CA3EDB9C08B6 9BCB90D84A30BDCD FC4022E26ACC4E48 C7C1BDD0D92F9B17 F653DFC292363F38 34C5BEE13D25AB86 47C3018308AB6E71 1140F8CCF94EA5A0 568EED56440DFE27 8FA05C83160DC8A8 4019FF8792666973 4A9D99371A23C451 C9C11CF049B350E9 991E5A4C2CC9699B 18B0964338503237 1678E1FE866C8E0B F6615421A0BE5FD9 DE3CD5F4AAC02570 3AACDD332D3ABE8E D6B894F9A904A10B 89AF4DF56C99AE8A 2CF7F1B36493B407 2C17827939D9603A 5AE8BA3034D94387 6BA399F6B03506A3 C202E05AB86947A9
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303230559 (name+title). Key = MD5(password) = e0c7dadd391fea142e0f929db80b643e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6db8bcd6-ab1d-0595-8396-8977fa954c51
  2 602371c1-7037-43df-a482-13a92706def1
  3 11079506-5052-5cf0-ad30-17469897c621
  4 3f7e11e1-fe48-65da-ac4b-da79ed7b8440
  5 f8a8cc83-510e-88f8-8e5b-45f4bb08f005
  6 795cb9e7-7621-169a-b2ce-1b36382e0fd4
  7 273aa4cc-cf32-22e0-a6b2-23cca158112a
  8 c51ab7b9-6a7b-14b8-8451-ddee7919f317
  9 8d724676-b665-830b-b093-8cb7adbc0632
 10 70e39ce4-277a-7677-9a13-138c18c0b397
 11 062b3105-7629-5495-a00c-94ad4c617ae8
 12 d2755127-2507-4220-a9b6-ef5aa2ac0c98
 13 8332649e-9cad-89b9-9058-2f25710855f5
 14 46e1c713-b53c-593c-a3fd-6b64034cb642
 15 f0989a5f-e5df-6f61-af30-47e52aad6144
 16 5189c4a8-5432-78b3-a98a-8c7e72376897
 17 20e81fa4-b5a0-6192-a973-e390fcd76995
 18 aea9bef1-e009-25ca-89fe-a0b500a80daa
 19 56a4ca27-97d1-505a-92a4-b916bbc2c021
 20 7b324eda-c826-1e3d-81ac-37374dc34e60
 21 a6977694-dfa5-8452-9bac-d15d16f73661
 22 b9ba3e06-87c5-6dcf-b188-331cebb374b6
 23 b2fb965b-7d67-8c87-a804-5aaf2f9cab99
 24 d3449c3d-0671-2026-beee-6b54ab72504e
 25 84b0111b-1f0a-1c46-9f2c-20e576e90888
 26 2e091ce0-1ab2-7015-bccc-9dbaae9f0349
 27 9d1d53fb-939e-4a76-8a03-0da5ad3f9ac3
 28 2b404e33-2395-5d16-ad61-5b96d0c42ad9
 29 313c0371-66da-0c70-8025-7b60aa16ca73
 30 de090d67-464b-5804-b72e-cb07c8792fcf
 31 1da70433-45b8-1f35-aa73-d4061d1fe5f9
 32 1fd94af5-abff-2267-b80a-c1ebe0e90868

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 04568121875485676251868217450512. Exactly this sequence comes out of new Random(994).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 43 (seed 120,022,078): new Random(120022078), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:44–10:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs