A858DE45F56D9BC9 archive

201303301044 1b9z20

explained decrypted filler

seed 111

Metadata

Post ID
1b9z20
Title
201303301044 → 2013-03-30 10:44 on A858's clock
Posted (UTC)
2013-03-30 00:44:58
Timezone
UTC+10 · title 10:44 against posted 00:44 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303301044) = cbfe047b8f6914330522329f79383609 (name+title)
GUIDs
36
Filler GUID seed
new Random(111).Next(9) ✓ verified
Run
Run 43 (seed 120,022,078) (seed)
Draw
79 · predicted N = 36 ✓
Machine boot
2013-03-21 09:44–10:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8A8C1508797B0A9E 8FEE84D03E9ED97B 71483B82A38831CA ED6A5829BBC5E74F B127DA106C1F06FE CF9A39A8C428BDE9 9755095A4C8068D3 886B1930867C3C00 4D45662D8A6DE5E7 4591D20E938FE957 E39E6BB2A48F9866 45FD0EE5F8152E36 69A9DCA9BACD5D60 BEC969BD765F54F8 60EB3ABC36AC3B52 6035533564C82F5F B0CC42E9F5774429 D04D962D2A744AF1 D7548D1B5BFC952D A46731F6A2B9B6F9 30CCF49B47D0F7E6 9A7BA9988E33262D 9DD9BBE4844B17C3 F05FC6E2A23E9E44 19D153B06A359739 BC7F8D60DEF6F34A C125E750030A1BD2 C4D73582E78D55BC 935228FDCC2748D8 A11D6AFD67D85901 F9DD8BA2DD63025B 0F667006BF010D20 0B47A7F806F2B906 CE018FCBAA03A089 4A2EE208F727115A FF7CFDB109C707F7 AC17D4550AFD3CE8 09726B4CD02A2163 1F172A46175E6053 A2C48EF218DBDEFB 91C1CF9D9479DD77 024CE7DCA86003A8 A573A3D220C981B1 7FC9839259807CF5 ECEE03C9B68D41A0 D4F44FF9E5E6BEF3 6D4D2B4E9D6D4498 4B04E6A21A1C9B62 E115EC103E1B2532 04B2596EE5E35CB6 4DA90B5CC5D8CD93 DA6775F42D67FA25 41456EBC664C2F24 69DB27B0785EED6E 15219E8521CAD7E1 C894C7FF8914C2DE 89466C521043B594 2034FB81D90CA45E F913C6C6FDBA21AA 65634B45554C21E1 CC0D01283059BB9A A60605C24E8D9F63 12F0FFE5A4710F11 9EF36F3B703D5C91 ADF414C90868A654 DA604482465F268B 8FDA88E27D03C192 20B539C86C79406B 089A1339737BBBBB 30FD2D78B8B4DAEE E32FFB42100FC418 6D7416BB0C28ECA1 8EC167A8143B3F48 F22023A7256CAB59 FE30A010713367AC 91EEC43577B1A496 2EA0F00A13B6D2FC 56F56D8427A255D7 CB84D871A6C15338 BE24890B3A8F88FE 907BF988B5128D54 ED330909757C8C8C CC63B568914C33EE 71A2F0634AB086DF 7C3416D6830A1257 0F2AF931E3A5EDE3 659CCD797D7B4605 01C7C1C93366EBB5 5432F1A4A241C69A 05237540AF69CF26 50D8E4E73C5E82C0 CC9261D7058BB3A4 C5CA07B5E79119FD C710474CEF2238D5 E69A38B4C6BF1E91 D3369170C798F960 CC4AF28F6BF907CA CF0A18267AEB91D5 250484D70ABB274E 5441EE94A3DB3D7C 61D7F3613B36FF0E F73736A6E106DC37 3D8E15B831944AF1 7AA43B26098A43D4 C48A8AEC55BF7AC5 823DE9A742E65AD8 8E8C18C69C4682AF 4B1F8E189AFC756F 4FFE68116D8AB992 23C5EF7C574C6798 D931144446A8A9D0 DA3A860E003F2A57 504EDB72B554DF53 405F80768D877455 D701569D8A44AD4A 847FED71D9AA96EB EF3FB297C72B3F8C 56BA0E36E2187F20 26E9EEB6023FD458 0960D68927161404 02F173B1243A4821 6C1EDC8268E97165 F25C438195EFE8BE 779F9DBB200670FB 1BB4730E08A18E34 63BCAA4903CA5D69 1E92F40BED6991DC 35AF3FF753161C04 0C0108109B55C1DE 87EA2B24BE2B397E 068E5B866AC0F7F8 5C898AD098A2ECB3 234C853BED26FCD9 DA72FB1C8FE5A797 F650CBA229DDA258 6DADF4CDEF63740C 604097F3CAB3C6C2 818FD1AF19B732C6 9EC7C6425288D9C8 638132A476679FFE AF4E5DAEBB9FB683 D0FBACD1A2CFAC54 52555BC28A054975 C115A6CB198E2BA2 27C374458D42D7E9
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303301044 (name+title). Key = MD5(password) = cbfe047b8f6914330522329f79383609, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2af7638c-4dba-68a2-8d40-3fe7ce4ccd37
  2 53998b76-c1f0-30dd-8535-d5fe9312fa4f
  3 2efd6839-4180-3017-a85c-6a7c6deed580
  4 643c92d3-09d9-2e2e-9aa7-a48381a79fe8
  5 d84996ea-7563-2217-9af0-b119eed56171
  6 464a48a8-de46-557b-85c6-486b7736a777
  7 d4f0b185-6813-5283-a2cf-620d03bf502f
  8 d0ff5b86-069c-1490-aa22-231a37dd82f8
  9 0d192d6a-b9cc-66d9-b9f3-fe7c3ce34a9f
 10 ab9af42d-0eec-1acf-b792-dffab7427060
 11 9fa377d7-0819-042a-9fa0-a0f68c146423
 12 8c495828-a876-14bb-b8e9-ec2011f207c3
 13 8f0ba45e-3763-8a46-a802-8ab9de40f2dd
 14 b316bce2-d6c5-1255-9219-d7b1418994c7
 15 a2a8a208-f5ae-666e-a7d6-d11152fbaf41
 16 338e2bf2-3ce7-303f-85bf-732f164c8194
 17 6ee94055-e23b-4b4d-baaf-8faa8e0ef185
 18 7c01babf-f456-70c0-8791-2e3c77c2cf50
 19 1a8b2bfc-d299-67b4-9a74-4ec90b2fa72a
 20 f3c0c485-7937-2abf-a550-35ca20354c8a
 21 64936f81-bb56-5142-ba23-ef2c043f0e26
 22 a4607a04-1aa7-08ec-a546-accc1d7f877b
 23 3636ac8d-37d1-6051-936b-eea5624295a1
 24 65905fc4-84e9-7ff2-8650-48d3edf63857
 25 b5db9d1d-446b-57cb-8f07-a996679dd5e0
 26 b5598ac2-b3dd-88ea-be46-eeacaef536b5
 27 08478f85-91ce-352d-b758-663fbbc2832c
 28 14becc9b-a312-4d78-9336-e2e76295b23c
 29 28d5f8bd-7092-1f3d-9a6a-4833e404e5dd
 30 5689a54f-aa43-403d-8ee6-754e9297545d
 31 239e7e49-78a5-119a-b252-ca5f19d38bba
 32 ffe951b3-475d-6e20-ad52-c794e9a952ce
 33 2b36f803-e8f3-8f69-9d91-9e2fad9d12de
 34 a7083dce-85fc-6e78-adec-52056d392748
 35 088e9422-3bc6-3712-90b2-e36a26f98820
 36 008f63ee-f5f3-5e4f-9f38-c46b50274e0b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 633225516101816347625067583414168635. Exactly this sequence comes out of new Random(111).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 79 of Run 43 (seed 120,022,078): new Random(120022078), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:44–10:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs