A858DE45F56D9BC9 archive

201303250259 1ax4sn

explained decrypted filler

seed 824

Metadata

Post ID
1ax4sn
Title
201303250259 → 2013-03-25 02:59 on A858's clock
Posted (UTC)
2013-03-24 16:59:58
Timezone
UTC+10 · title 02:59 against posted 16:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303250259) = dad378602d48e46285cfe8d8183cd2dd (name+title)
GUIDs
36
Filler GUID seed
new Random(824).Next(9) ✓ verified
Run
Run 43 (seed 120,022,078) (seed)
Draw
10 · predicted N = 36 ✓
Machine boot
2013-03-21 09:44–10:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3C78614E4329794E B6D9924FA3979F7A AF27E5BB403EF6EF 819EABD9571D8432 C84CD6AFD0E8B5E9 CDEB3CC8F656CB71 AEB23BB5F1DC3573 29539A2773DF78A6 97A6595C150F46FC C5CF9C26C41BCEAF 135A90D2D451D43C 5BE2387546BE665A 9D5261ED435B4C71 59D793ABB6B4CAC9 0CBC9A8CDE576923 433EF055B202E9EC BFFEA924726BC035 7DC8245E73900BEC 56B5A3BEC5AECD85 9072451027B16323 8EBD79813E81F04A 8AB79A120489A63C F9EC0C9C1512D4C1 AEC8C877CBE126A7 DC8629F79D6E1C5A 9877BDEBFDEE78B0 155C40B9499DA0A8 59D43FC0D818E82D A5DCC57EC7B08518 CA8574F984EF0312 8DA8E26B0A360CF9 F7C6ED2C2F027660 F7CFE71CD7481184 C9CC5C693B0D0FFE 90C2DB4F9DEFE12C C584B67340E0D22D 721FFDAA755A545D 4DF89B0DF2DBC975 624536C6319AB7A3 413BD534CD82BF19 05B70B3D1CB20EBE 9393E00BEBEEC5EC B2E2D0829CE0F8E2 C4EA25329BCCD917 A918922CA7539192 B1E59609991AEEBF 471B5C5E4F9CCB17 579A555D0492025C 27E72B20CDFCE8A3 40E2F0FC8553E6DC D5442757E1092E6D 9C7A373AA7C7CBFD 670BE39CE20A8EA4 6ADBFFA23627B7C8 151453D784DD6C27 A8F154BF7BCF3C38 162B7BB6387D7DA6 751DFB0E117EB2AB 2A081558F6C89D57 D3763145A1D1DB0A 7BC76D38EB8F4464 EDD163F86B5EA3F3 3EF8F184959E7CB9 D7D6E4A533BD4ECE C20888CE1ED19CD0 62A97E372FF13233 431C3C07DAE3128F A1373DF57969029D 48D4B8CF378983E8 B93E779C2BA2F44B A8B17B1D1BBB31AB C2C2CC17DEC6F2DD 2E84A44B361AB6C7 B55191A60AB743C8 795E503F8C4477D5 E770AEA7B533D3AB 03D4985DD26BE1FC D2CE31BDF2E58C44 21E9390A5910070D 23B170F285A754A9 7E6DB94127559551 9E0CCBBFA12D62D5 AA5C34DEB73EC002 8FB6039E7D99EA1C 324B29F713158252 5FEDDAEDFC68A8A9 7380B09B23BC70A0 C43EEF1907184CD2 854F361EB63DBD22 AC49B0F7788D1742 50773F69DA4AFA08 22B1E4D426D3F5F1 EC935F2D742E6652 D3BD835A4A1D1385 5D1FA183DBD74216 44F03F747FC62083 6BB2B1B4F024E38D 6FF0B683025B76D0 21DF1B8DA3ED7483 148957ED61C6CCC7 527DC193209276B6 E002C2D8D13B2EF0 F8209098D8FBD79D 620F9EC2540F9E68 7DB728F20D8DEB83 25678C0E3D8D3B65 F86F5524658E3084 CBD4350EAF060559 D54B7231757E6D8A ECE769FD7A93E1D8 75B061DF67A4E9AD 875487AE0A3CCEE0 FF398E79FA4DDF89 7F0B90759553EBF6 E499B20FF04E25BB 2F5E2B069CB469CE E9C7E60C7245DAC2 BCE5F934257DCF2F 789B98960011EFDF 68FE8819654184DA F9665089583A505F B57296CEC5A2C31E 200273F5A9985578 670058A8E54C0886 15EF9EAD46DE3BA3 97591A277F0788F9 4FE2690AAEF593C5 12663DFE3965119D 1B92144E06752379 4EA981A013B13FEE 711A3D9A4CDCEA99 990C1E38C75F46D7 299BF8F680BB2A3C C11502463A1BF16C A576948F0A6F408C 2AF598CB9C36440A 11396422D7B8349B FC45590D1C8BE5E0 CFB12E2D0F334EB0 7A7243E8E29A32E4 5B8B235A06AA1A9F D01CB8BA0DE5BC7C 4B750DF5949D5E83 16885CDEF221D117 2FDFD9E0651D9BE4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303250259 (name+title). Key = MD5(password) = dad378602d48e46285cfe8d8183cd2dd, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4cf16eda-8592-16c0-9a9b-71d5db14bdec
  2 0e946dc3-d78b-5eb1-a873-14e07a33d445
  3 b07dac4f-c305-6d05-8308-d3d5a0cb934e
  4 fa5c8d22-22d8-3ae7-8d7e-fc5af71ba910
  5 a3dc0f87-909a-2b85-b755-c2cedec15805
  6 8089b72d-2e23-5165-83bb-ac51eec8e2d9
  7 6634c2ed-a6e9-094b-9b39-366083596358
  8 3759cebf-abd7-7160-b946-206428a9d75c
  9 3656690e-f0d3-8211-b8fe-cebb9f4d1da1
 10 52000cd6-09e7-1eb9-bcbb-24fe7d746eab
 11 22840369-258e-3d20-832a-dcb5cdcf1309
 12 f93ec0d2-4a6f-6263-a348-f3a281d7a127
 13 76d1284b-e4f8-0dda-a149-238f06228e5b
 14 05830765-235f-1b57-82b2-e585dbc706d6
 15 107c6e6e-514e-6852-b2d3-b00c37aa8fbc
 16 899acc63-ae99-563e-9921-cf2288accc3e
 17 74d737ca-e2b1-2149-8a4b-9f23d80dd9ae
 18 b49bf9e3-17c5-7f8a-b5c0-017c24c06060
 19 e3e9a71c-cfcf-8c69-8c05-bed061ec7d37
 20 a1d4bf65-5d12-3b89-8033-5357798931fd
 21 4aa8fa09-3038-2e00-b0e3-0bf4e2174c0d
 22 511be3f4-4c77-07af-9010-2fef6a29b195
 23 1daaf36e-5ba5-20c9-9677-a50468c9200d
 24 13054713-9058-8cc3-808d-cf18bc543bd9
 25 f1730ade-0c19-45ca-b3e7-757e7d0d4a4f
 26 47c6f181-b855-4d42-86e2-044bd1a5f2cf
 27 b97b1f78-74f0-30cd-8b49-c4aa2de88a3a
 28 9e945dbe-e661-2932-85b3-a3ce2742dd0a
 29 696480cd-e28f-1067-8bc6-bf5231cda66e
 30 c2398961-e0c4-605d-95b4-ace70125f370
 31 8a196d74-4ba6-3e68-9657-5c3416973aa0
 32 eb7da847-299c-42a7-8c42-1626ef073f45
 33 f752ef75-25a3-5714-8c42-e2835ba418b7
 34 f11fdd12-98cd-5e1f-94d8-9195ea9afad1
 35 f71ac32b-c15b-3f76-b4e5-54ebc71a82f1
 36 00690113-54c2-48d9-b082-2a17f7570441

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 156325078136016527832028443216345534. Exactly this sequence comes out of new Random(824).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 10 of Run 43 (seed 120,022,078): new Random(120022078), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:44–10:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs