A858DE45F56D9BC9 archive

201303282259 1b6a9m

explained decrypted filler

seed 522

Metadata

Post ID
1b6a9m
Title
201303282259 → 2013-03-28 22:59 on A858's clock
Posted (UTC)
2013-03-28 12:59:59
Timezone
UTC+10 · title 22:59 against posted 12:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303282259) = 61b1d6c5395bb078ed391871ed955056 (name+title)
GUIDs
36
Filler GUID seed
new Random(522).Next(9) ✓ verified
Run
Run 43 (seed 120,022,078) (seed)
Draw
40 · predicted N = 36 ✓
Machine boot
2013-03-21 09:44–10:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E574B599A73DE24A 240C6109B69E19A0 9FA1C0007A08C805 8BDA5AAB351DAA4C 5274F83C5BFCFDA2 9FC4B0CCBE80D57A 801A1A5078BEF03A 12548C72B7353ED3 62504FFE1A1A7B32 8A4AC1CEBC5F9BE2 E82D504A1F213029 477A35B1A84D1E52 B2FB7BE2CDEA26D4 CE259A3C6A4F0239 8217788564D665FD 3BF83FD93CA880FD 86EF19B0E1E8C9C4 328587657CCDE9D0 7DA4C1F2E82F9C25 B26BD2FE3E06163A A1C9E93FDAB26066 3CBD10BDBEA594E2 E610F37579ECDDC1 27E5136700C94A0F E3526BF7C6303D91 3B9D585379E2736C EBE8FED09B58F53E 288718E581948445 223A59C4F0D63A62 5CBB3383B52A78D5 41CD12795E40E614 F5D5CD9877F54610 936F236ADEF17D66 465DDA6A2BFCECF0 DAE52FF4BC57C606 866EE15CA9E1C164 5CBD498BFE0CE62C 029F9D8C2DE6CC25 1BEBB616A110CBC0 E0122409BE59821D 8F3583E99CA85878 898C8236887C630F 39D4F22461D91570 9E5AC3D23ECA449E 820A5463F1133694 7264846A32744B1B C5D59BB4EB353ED8 395225299DB146B1 EE5BF4034EB64BAF F24A7E04E67A4D15 0695529753A7FF86 7A878D4A45FFBF24 84B4D68DAE20E3CA 5656FE55C578968E 2B5F28D324639DFF EDC804D24626F5C1 E8A3E33F871280D2 991F44CA07AA6FEF 306E4716979B5600 977F5EBC3433C12C 669BD014567D32CA 5553E753415AB5DC 1108B335CC0CCA07 A81FF5829B45F5EF BF4FE40280E04A56 2A2D3DE3188C7930 6C00F9B7360F8EBE EF783DE12BE9876E 21E16CC34549411E 39B0984FC7E122D4 A8C47D12CDDA8F66 3AC2F152DF7D0198 77063043CA684F5E D7EB76676CB135F1 C0FA65A9624D9DBB D2C1F254F959A2C6 43B52B1010EAF8C1 D8DCA07A4B127DD3 F0011219DCFAFA36 E536F9E8EEB173C9 75600D69B08D5372 77169D2FE3DE456F 9DF7BB9778238F7E 81C00699F8CFE6AF 9B3B5A28B38AEC9B DB3E812244BC638D 3093B5BC51EC3F89 87B0F50E31339C1F C8D19DDB12903476 0A70BBF575F51D2A A0EF940F6D439952 7FD4311074C25B9A 9243DDC300C7926D CE230334729AD1B4 5F946721BF89FCD3 869635E2EF61B313 4003958799D1AAA0 57E3E1C62EA13EFE A5D8F6273934A895 119F6199D380891B AE2F5AAA2A126801 AF8E2C5D7615AEAD DD4213F074BBD642 C1515946B97E2FEE D12E4F0002775D7F 1FAA97EFC673A06B 8081ECE83D6BC951 B2B47C2ABCF5FB67 956E8BDCC2A013CB 41992E90967C4DAA D8C706E09CC9C5F1 64594D2A9C56E00D 3D1CBAF527375CF1 2DE9945E3F0CA370 625E6824E71B5C97 E47B3BA1FCD95B22 E56EDF6FE4B7C70A 321F4B12AB57DDF8 A807128FF00621A7 65576BA96DD15FD2 6AABDE88A43EFA62 F88070F09BA3FF6F AC4B8B162B52E007 E06EDC4CD84747E6 F8930899AA013FE7 441DA85B39B4FEF6 00997BA6B22B7F21 5A5EE56C9A4ACDDA DC9319E5B08EB087 A814933F84C6F8D1 65EEE4E073AD2CA8 1C252632C519D690 80E3F750BB8F7FDB EEC8A5D585EA7CDD F8A7681599502EE1 B52065F01538CFBD BE7893227B0106F2 8C846C5F8CD1311A 16132A97A7720D88 E9790F88C311B53D 247AEF84D7B32394 626CF74D8410F28D 18020D34F633B797 50D1FC0711134EB6 7329428C2EDEF77F
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303282259 (name+title). Key = MD5(password) = 61b1d6c5395bb078ed391871ed955056, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3ef200e5-4db8-3449-8605-e2285b72d400
  2 a732decc-4964-86dd-b57c-0190960b6edc
  3 d6777c1b-ce3d-5efd-bb1d-eb6a99fb0382
  4 0144d6e6-4e18-86cc-83f5-28ae74b0377a
  5 8926e371-90ec-755e-af15-f83f16d13cb9
  6 4a9ec006-6c65-6997-a2f7-69aee6e9f395
  7 2dcdac86-1d35-777e-824f-0722cb55e161
  8 2227d0e0-7981-2460-b5a1-450e2f13eba9
  9 1a7f5d1c-0534-505c-8f1a-1bcc1779c6a2
 10 86263ef0-b430-6a07-99ae-3572e6152415
 11 7d83b920-28e6-7bc5-ab10-e769fdc24172
 12 dbc878e7-dfff-06dd-b2b9-6a2cb54f541a
 13 fcd788d7-93ca-45ad-9967-83eb40961370
 14 3ad9fa50-bbfb-0c62-bbc6-d2439b897df9
 15 19b98b2c-8117-32ff-952b-aef8ad98ca3b
 16 b6d33340-eaf0-0ff9-afc0-c78653d43b92
 17 253cb5ae-913d-2ddb-8d4d-ba6580a2fc8c
 18 7a7a349c-e661-5531-af22-36577f78f1fe
 19 753ef2b2-3460-7466-a779-e57988c150dc
 20 b03b2845-a568-380e-baba-c8b1177453e6
 21 b2666d02-9bce-1795-a1dd-c4ac54737e2c
 22 b9eda669-f121-8682-b4df-c31672fa8a21
 23 8ded7389-0b7a-1b76-b18f-bd7d95a367df
 24 df68637f-1a56-37e6-aa9a-c07a928f7483
 25 16e452b3-30f0-7fd0-a60e-2dc8b752e3b4
 26 7c5bf6c9-3ad4-2857-96b5-2796b1934613
 27 8ef06735-30af-65d7-a596-3ca01ea04a76
 28 3b4f71b9-b6a6-142b-a23b-c5daa4cb250a
 29 d837bf70-44c0-6302-a092-38d137174e67
 30 394f3e34-3207-4761-9b5d-08987ee71ff4
 31 098ae641-9c11-8a0d-9942-def4a2622796
 32 46de4436-47ea-8352-a709-b678e40259d9
 33 c19208d9-48e2-18e9-8e47-783a0f58bb07
 34 e0edb20b-4e55-08fd-8a25-d6dc5315a4f9
 35 d77aea53-e6b4-8755-960f-881742e9ef8e
 36 7c116334-8bbb-3d27-85f1-684ac1380509

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 385876725670403025731813726164881083. Exactly this sequence comes out of new Random(522).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 40 of Run 43 (seed 120,022,078): new Random(120022078), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:44–10:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs