A858DE45F56D9BC9 archive

201303292249 1b8lx2

explained decrypted filler

seed 556

Metadata

Post ID
1b8lx2
Title
201303292249 → 2013-03-29 22:49 on A858's clock
Posted (UTC)
2013-03-29 12:49:59
Timezone
UTC+10 · title 22:49 against posted 12:49 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303292249) = a6c10c9392c1888b313f1cd8fc4558ff (name+title)
GUIDs
36
Filler GUID seed
new Random(556).Next(9) ✓ verified
Run
Run 43 (seed 120,022,078) (seed)
Draw
66 · predicted N = 36 ✓
Machine boot
2013-03-21 09:44–10:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

938FAE667549448E F8E53E49A4761269 9A1701D18DE22200 1BACFED1D0B786B0 3DD1CBAAADFBBA00 8FDC24EACC159C5C 8932E07D80C98ED7 50005772BA040B07 8AB72C15FFE7896E E96FBF617CB373B5 2F5BD1C91E7A954F 1B0F6DE04EAADF31 D4BF90E5F036259D C582924599D22F68 5321CFF63367AF99 C4131FAD3E5C8BB3 DE4144580024DB4F 827D44C907DF6668 C3A40D01C111A714 F4A279FFBC8E79BA C8DE492B03171F7A 56FEB35763C0ECA5 95FADEEF7E39C484 F367BC73A66680AE F869F23F449887F8 6E4FEB3818CF8299 B698A1E97C119354 A04C81AF7B84F7FB 19AA682BD59E2D20 DA046ACEEB16FDC1 8519D38A1B15EAA0 53203D396F65604F 6F08800CD5B0A821 5EA14CAA9F97FF61 59694FE19E1D232A 6517C3A6E43BA437 CA9598A5BD7C825A 79FDD9BC85201CC7 71CDE22E0E794A4F 12CC273FC43A282F 8D786E4FE491C22E A7722AFFA1D3FF5D C575B9D503C10F5B 83695EC57B6DC72C CD53566E8F1D3BB1 0FF23B251B262375 F09411561853FB9F C3D67CD03402C752 DE986F26448E3205 B2A84711DDCE6255 EF181064CB2DE291 EE8C653901BA041B DDB0EA327D8CB77F BB3C348BE6AB5515 A4F5A88E5FB96758 B43073B706ECD14E 59D803002058B743 569E026AE2C03C06 4808F75E5A32FF98 7F3A2F008360C9E4 B8733F0673072695 D8E6AE804F5E2E86 1BFD72D616CF9256 96FD8211615217C5 811AFD196CF234A7 CEF8A55DF998D529 C67E53FFD085789F B7750F37A089D829 B1EB256854963A9D 41C64CF52BFC9654 362917AA1598F2A1 D6A3F45286685C21 C87D78F6FDDDE861 7706F4BA1684658B AC54E48A12448ED1 178D2310F77C48DE 69A6E0EB16639582 10A4227096B19DB1 69477E5840B44D27 7B75AF3A09B509BC 13330943232B90D3 86063073DA39C82E 19B074F5B76D0001 711E467A666125B5 F1CE0DF72E2FD603 AC4811BB77D32255 3DD5022E21430776 2A6A91E6E5C7ADBE 2565FBF958B46BC3 D973DD297B0189CF CF4D9F39414F953D 49302FB3D92427A6 D94FB4DE237B05AB 9A04D365640D892A E511F77FAE603CE3 5529EF194281802F F900D2D45B65D365 24F9DE602014CA33 F8A7A8D5B147B40C FA8668BCC9E861D3 EBA40D9757E8A321 9EFC20766611FD78 BB6A7D5F54D274E6 409F6021FE79D7E8 CD1238B698714220 8EE1588831CC8A75 7E245BD3906F6A59 A828A0F4DB14E481 A44F56406499A9C6 D879E2E2DFE2B6BC BF8DB7FE76BE5A03 FD5B48CDE2C856F7 D7F208753FD6F23F A9C2216A1AD8C8AE B6108D05B5B416CC 5170D30F1C44665F 3720E27ED4FEDA67 E3649D2EF7E4DBB2 303CB965EFFA96A5 72673A9969E7428C 758B6A4C34DEE519 F22F9C9981A1004A 13F16ADFD5108530 E4C8E68BC3E5822D A1511AF4B53A0D77 3F564C09368C6C72 0DB78471FAB19EDB 902758571ED52541 0AADF54897FA5B76 D8701CEFB926A77D 30F3D87DD8E643A0 8AE1155E713B8AE7 1F9F3F32448FA3D1 C39A3320F64A77F0 DBCA44ED0A8B9143 094EE9AECE62E33F 4BA45D5AB90A04F1 4836D2EE78B5F49E BD1968916D7B7AF7 0046165DAEEB71FD 4B919A71F6108A24 BED4F8D070ED707B 424E084FABD1D7E7 489C3A62C6645DF2 F76A9BFE07F65D6F
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303292249 (name+title). Key = MD5(password) = a6c10c9392c1888b313f1cd8fc4558ff, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 94039755-c6ea-1598-b805-d5f9e5d3dbb1
  2 a7e8921c-223f-8b14-b15f-0d3240a061ed
  3 a4dfa5fb-f55a-375f-8eb7-a224b2b81f46
  4 694d1623-0c4b-2a28-be46-38053c02ad23
  5 6a76b36a-facc-203a-9e1d-3b1c65dc7c5c
  6 75b8db82-bde9-4224-9799-c5192d8740ae
  7 80aeed31-6f95-03e1-a1ad-c6eeef754cbd
  8 9b41f37f-c70a-31da-8e13-bb46c430e40a
  9 1271ac68-be2e-65a9-841c-67594bea7023
 10 7c226a97-2abb-2b72-ae36-54014a015604
 11 6c84d195-b474-83e1-b610-f9a9324b45f9
 12 afa0b338-41d8-4f84-bfd9-f56d7c1e128b
 13 ec140da9-a992-7a0f-9b78-929404db066a
 14 a0021925-fc0c-6f64-a396-b4b865632a87
 15 09918a13-3c18-182a-bb62-898ac1c392b1
 16 13e69725-516c-269f-9693-988a68863c6d
 17 55aa31cc-45a6-5789-86f2-4d798ffdc802
 18 112178ed-c784-6f93-856e-404b720367cb
 19 2bf440e2-48df-6e42-afd8-b7fd45689205
 20 38b2766e-101b-5981-b975-e6fc303f81ec
 21 5a46f9b8-7a1a-6042-bd0d-48c4acbacbb9
 22 c9a2c5c1-6a82-27d4-99e9-48ea03a8844c
 23 2a64ec01-b963-86cf-9f15-b751eb83b996
 24 a06440b1-8832-21c4-b56e-097bd30212cf
 25 ce414c17-e042-1192-bc92-f239cb385cfd
 26 8d23ed34-e0a8-1f8a-b271-ff9e5c779798
 27 e0f8d2a6-20cb-8b97-a3b2-bba8422af7a6
 28 d5c84a6a-e585-1d1e-a58c-59377a83d7b9
 29 895a70c0-2b13-122c-9a04-2f424b8b7484
 30 54f20c41-6e24-7f07-970e-fd898634684c
 31 27ee203a-3dfa-448f-b0df-e4107b4c04ef
 32 48223304-afab-80e1-8fee-21af4b3e92e2
 33 7adbc9cf-487a-7f10-bfb7-27590182f137
 34 4ffbe4e4-2863-8619-a96c-b9a17ea70682
 35 41b7c901-6a7f-7c6e-82c7-2abbbb894109
 36 2c0cea56-9de1-7f67-83f8-b19eb16fc5c4

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 183224036284761256656282118117487877. Exactly this sequence comes out of new Random(556).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 66 of Run 43 (seed 120,022,078): new Random(120022078), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:44–10:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs