A858DE45F56D9BC9 archive

201303301954 1banxi

explained decrypted filler

seed 759

Metadata

Post ID
1banxi
Title
201303301954 → 2013-03-30 19:54 on A858's clock
Posted (UTC)
2013-03-30 09:54:58
Timezone
UTC+10 · title 19:54 against posted 09:54 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303301954) = 3e9680adb77bbf6e07f7560e190e6ee1 (name+title)
GUIDs
36
Filler GUID seed
new Random(759).Next(9) ✓ verified
Run
Run 43 (seed 120,022,078) (seed)
Draw
89 · predicted N = 36 ✓
Machine boot
2013-03-21 09:44–10:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A273CA853052A5C9 AA2FD708A3D6D9B5 0DF600F725B0210B F8811B52F2D60478 C10986FF5320AD3F 79FD52789898157A C0F229CA576A5F60 212E5504A3AEDDF3 F2E8CECD1F627A29 90891C9E6CAC4DF0 605E1AB3507DF23B 3192BA1E2BDBE71A DA3873921E4FF1BD F5E1A0CC2C0F16F7 D7E6A116B70599D8 7A09C2BB23C08160 7AAACF40D8634B87 C8AC92B5105224E1 FBD704DDD5FFA94B 25A6DB795433772E D8CF75EFCE8E1B41 1F8085C8B12204D9 D89A521D07EDC505 83BE769CFC71A938 17FBB3756EF786D8 D85B4281FD59BDC6 B1E687364CE5FDD3 058F7966D70471E6 C579D689472F0D8C 29193211A71F877E 7223F1CDBB88E198 5371002851BFACA7 B679010EE87689D5 281D1FB436307576 528C3207BA533549 56DE6192DD088A5F 3912E4F81355611C F09F490AB4471FD1 C9185D49F8C8BB74 990C3594B5CEC236 202B9EF8598F40F6 018086DD5EE3F45C CD88279A1F52296B EE21AB6DD0896F32 399F12D4AA165E82 D805080B8122A531 C04329C327F17D27 FAEF23F9349DA146 CE63586A578F6059 75E94522BC7985CD BC63DE6FD24EE7E8 E36742B2515A8557 9572237E3BA8565A D67DD105CF798BD0 1BD136B87373FE6B 423A321FAD708BC6 84D5AC97759C4996 86967B512BEE0C4B 38DE43588C58B806 CFF4C12BE5F0A389 8E3C9841E2B273CD D7150C43D67A637C B06FAB65DC6074E4 910E7CA7A5AA0853 198A98ABBB93E2D8 F432DF82337E67F1 01DBE62DA369641C E55556A351E6D08D 1E487CCCDBC66689 65756BE55B674828 D8BC6D73D25577AE 733E1BF78166C9F0 A6CB7DD624432878 4BBF341F2B94F89F 8012DF00320ECDB7 55172D07C6E55846 F3854672C2A5BE6B 9CDDA59740412558 25B4CE725CD5DC76 FFF87BDF5717D747 10EF4502A832ED9B 29CE0FEFE42885EC 030598E089836FAD 86E0F5C763707E6E BDB1A1118CB14FDD 98C1EE8A2AE76597 1B39B96857B12527 BFCE9464246B8AA3 E58283DF43651483 A36291EA4F5D5824 419112AAE6DED762 EF88EE793EF5E730 B7D7A0848AF9AB6F 133332785E675E31 BC0E30E970412CEF 0935545655102B37 200B136D08F62684 C99A528526498D9C 89D4B953C1B9C43A 60F536D50DEA0923 D0AEF64B9E53FB5F B780DEF09C4FBDB4 9451A0666AC7E978 9A339C7C368B3DA3 0CBC41898C96B01E 66ECE390A01B1023 31CDEBD3EDF94263 0EDCA724050CEB52 922FB810751D47A7 D374E27E8A678AC9 B40F5283C70CE21A 6DC7A2F5F2D20B05 BB540441B66C4195 B29E6E9A31F3A8C6 330125C4D72DFE41 F4B979AABCF00028 408C42C7DF2E03BB EA15D114392E1FA1 6D6033EB57DC6D23 74C3438D39FB6FBF 36FDD8B3681ABC23 49A4B6DE5E2995C6 C76875DAD7E3FAC4 3512621961707ABF B7366FDF53AD030A 6D2962F08F72984A FDCCDB4A2CCE5ADB D932DE0324B3EF24 6C33166EB251B75B 89F01056B112D170 D9B563FB4C600931 86FE9FCF308DEAEB A1EB32ADAED53E84 2057B5492A59C5D0 85E49D65F59937E4 694C33093AC4AFEE B3E589EFED53E2EE 414ECA176730079E 725B3FE29E99096F A11864E9F9892D56 08C13B776412BF84 52BD08CF632AB79C 71624B457F7DB64F 4B20A29F899847D2 90DDE466A6F0A48C
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303301954 (name+title). Key = MD5(password) = 3e9680adb77bbf6e07f7560e190e6ee1, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f8993368-6d66-209a-ac8f-354ce6695699
  2 c251502f-12fc-4cf3-9b49-173e189a79ab
  3 8ab48e79-104a-2ab1-9d79-97796050a41c
  4 d788780b-2a92-5956-b36c-e895e640b641
  5 2bff919b-aafa-7d58-b32f-bc19ade34e5a
  6 69464a57-ad76-7736-9970-c826d7874ecb
  7 a9be3cce-5c72-87cd-9110-0ba01f4f9b6e
  8 e70db424-ea9a-1f05-93cd-9626c1e49edc
  9 4a7ffa19-e01c-72af-a540-0d86c659e6b9
 10 1d88297c-0f10-18d3-af22-5d956199c4f7
 11 1111f4b5-8b0c-43ad-a1eb-f796b8570cbc
 12 30e8ca22-e1f6-08de-ad6c-152782161959
 13 341760c0-f772-3454-9b1a-0def9418fa6c
 14 61732f8f-03fa-351c-be94-153de988599d
 15 8405cc32-8ddc-24f4-9228-de237c6dcda3
 16 ba3a3ef2-2883-01ba-96c4-7b35eab1b8cb
 17 427eb134-bbae-83b1-be6f-4fd6f8c2f160
 18 815ed599-2b8a-530f-abef-5c8fa4af6884
 19 7041f715-2e43-21af-bc76-571a307ea8d1
 20 d258a667-88bc-1d62-b225-8a98e00d6677
 21 caa9150a-845b-53b0-aa1e-6e55ee931785
 22 cadf64b5-2cd1-0306-bd3d-4e0d639b8ce2
 23 cb9f1b2c-c13c-2d02-b7ae-2d81312c72e8
 24 f99b7bce-c45f-13ec-a6d9-99b99cdd3098
 25 e7fab386-aa74-0cb8-a4cb-95ea6602e288
 26 e429cfad-6070-65a9-b0b8-037a285e4af9
 27 493ded9e-49cc-4b5b-a5e2-89e552696544
 28 3f7f6487-dddf-8ab4-be1f-07782c9dc301
 29 b508cac5-d1a4-108d-aba7-5463ce2ada84
 30 fe5f72c7-c0e6-3adb-8b07-25a7dd4e893a
 31 a03c37ec-3790-3a1f-b142-db08c0e3b75f
 32 e022a62f-7d9c-3193-b33e-8bc75dc41bf4
 33 bb860783-9470-4de5-90b6-3b12e523ed39
 34 0978725d-91b1-0c2b-a95c-48f362a0b453
 35 df8cf01c-1e9b-6281-95f1-f9d0ebdc5041
 36 676b67d1-1115-5ec3-b7ff-4acdefc29624

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 242577817140332085215021064813334065. Exactly this sequence comes out of new Random(759).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 89 of Run 43 (seed 120,022,078): new Random(120022078), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:44–10:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs