A858DE45F56D9BC9 archive

201303302049 1bap9j

explained decrypted filler

seed 762

Metadata

Post ID
1bap9j
Title
201303302049 → 2013-03-30 20:49 on A858's clock
Posted (UTC)
2013-03-30 10:49:58
Timezone
UTC+10 · title 20:49 against posted 10:49 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201303302049) = 9a528436fe88acdc211e37a82dbd6922 (name+title)
GUIDs
32
Filler GUID seed
new Random(762).Next(9) ✓ verified
Run
Run 43 (seed 120,022,078) (seed)
Draw
90 · predicted N = 32 ✓
Machine boot
2013-03-21 09:44–10:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

44022DF330158B9D 552D0620AB1655DA E5358E343EFD1DF4 4FED3484C6D7C7CD 7902D67F6BE38CAF 7877A5A6F460E138 76B49DC5821A05B8 E605C4F2699E9274 92A348D92E7FB0DE 29CF9BC33635848C C84D5C458DFE6DA8 32D1C6F7DBAF859E 0A09E5369FFC4A17 CE5910D9F12BCF6D 41F06097681B8E42 39ACCE2043BECEB9 1E0F1E647150C95A 3ECFE5E29E7CE470 FE2B33D9AC4C7D77 2E13D595129CECAA 6955B478F436B4DF D517E7D5E987AF66 7229100659B7BCF2 BC074E4CEE6B8A22 5B495F4A6AF9FCD2 D838240811B36315 AD5513E949D412E4 54F294A49B1B8907 8C18A8B123613130 C8F338B1673E2C62 BC33D02A51C4C461 FD41CE94AECF2ACF EF3EF064A17CD41E F4A3503557709379 99E5FB8A1E2EA84E 1EC49357A1DAF193 5D83219D0F25AFE1 AA1ED6453EC3FA58 EA9AB4F40D7F3E27 305C4DBF11991FF9 321F21E97ACE6223 E15B847FC00C0135 1F3504B1690E7FF9 513A7D700FE157A3 ABF57FD260059D6A 3A6D0F47E776A0E8 E9C45ECE5BA52415 9E1A553E25948218 3B7B53EBFAF4022B C7E6A7FD800CE37A 97A072B8B44AB1E8 0C5070F9480C9C54 F7A9C178E4A4F10A 97B5BAE0990CDF8F 289E3A17D8DEC76C FAE63921F39FAB9C A0A51EA4C323894A B062D811357F861F 28C914AD928B981C 13DC8F03FFBE12D1 8C8CE430B2BD1FED 030DF3AF4E15FB83 15A20E04188DC571 11DD21542227CF6B AC65A41099032AE4 F0B6986600168A22 C9730E1E666F1B95 3BAAFA2DA6834794 775345957189E3E8 6FE66205619701A4 D81AEC5FBBEE4FA2 848E9BEE32D6D66E E85BB19E4691AF94 440E2EE43EE5C530 0A24186648AF746A 2A5B19AA0C74C424 655C0B2129F8BDEC F7ACA1A6260DF3DF C7FDD8BF907C57A0 2DFB6661032B924E 2605368F476A249D 3FD560A8B068338D 96EFDE2E08A934B6 2FAACBCF3CAF3C79 31D301DF80AD271D 377F38D7A0EF875B 9B836DF5431ACCC0 8A4156EA83955015 06429F58FB6F4AE7 1CA2A2F7821F0591 0657FDE6312D5198 3F4455B7A9E8E282 85C420E34A65982C 2783814992D55776 D2823AD9E6C0A40D 58E1846E98389959 FDA56B35B0D93F27 3B50011A5B5BE6AD 6AFE8430E21EED79 7ABB46CC0661A5D2 C9D19345D3C51754 38D122790680C147 E0449D78C5D33500 89A66A79946FDB66 4A8714562E4712D5 1EAAEB673D38671F 7501D9B8CC2524C4 6460FC65A0A3F88F 8E0A294A76DFCE2C BFA658BDD06D0270 E2A24652EB49A7ED DF5D320F9F141245 3FE8D4B2B89FA8CF 281EA6F67A89D18C 1DB190991DB7A1BA A8EAD647BDBCCEFB 190C0C2505539A1B 5BF7F2FF90DAAB04 E5B29631E6F591C3 6E6F931460F07E45 57B58BF39F307055 454A10FBAFB6C9BC C5840BFA323BF80F A1D24BFA23D6B37A 3CF103F35E06A8AA 41F0AC3A3DB2AA52 8EF45139FEC3F9AD 2C419479A72F42EA B6069157C33DB08E
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201303302049 (name+title). Key = MD5(password) = 9a528436fe88acdc211e37a82dbd6922, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 acdb9b4c-0fb7-73a3-9adb-04c4e41fb0e0
  2 7a96079d-ad87-32c3-9560-55f77502df4f
  3 2d3c023a-a512-338b-9fee-cdd1fe32f851
  4 0387b851-2406-1bc0-b923-86e8a53f08b4
  5 4e186155-f475-2528-a007-fbfba7bcbfa8
  6 b3eaed6b-9e97-4664-9a29-9a21b257d18c
  7 3233b2cc-5dac-251e-b23d-572b8520f8cd
  8 3a343cc9-47fb-6901-abd7-5d4661c3dfc1
  9 dd94ce06-535c-207f-9072-776decf1b5ca
 10 5f3d18a7-e7f1-29cc-b21b-ce55d29ec3c2
 11 60cec04b-e4ce-62c7-871d-154b3ee83f77
 12 7d6bbd02-b8a2-39d8-8413-c75d4a91efe3
 13 d369ae11-614d-4b94-9493-9513a7ed79db
 14 95ae6332-3e5c-8fc3-8881-bdf7d0bff36e
 15 2c4721a4-cae2-3a9f-b673-22b340028a69
 16 6191df78-a1b7-81a3-b410-7ecdf8acdebc
 17 5814eb4a-c811-188b-b467-80a208861897
 18 01c4aeea-816c-3185-bf1d-3b85dc5911b0
 19 f92e1438-e5ad-20d7-aea0-f336125c7a5c
 20 3f3a5e13-8b5e-34e2-b1b8-3736d96cdefe
 21 4de69b15-0855-0cef-b08a-ea749caca6d7
 22 cb170e24-b3a1-776c-ace1-2e34b5e033d2
 23 df0f7fc4-bd17-66ad-92e2-d59bcf2cb9aa
 24 b0b7bc0c-5b2f-2ea4-8dab-91172964ccd4
 25 e234e7a5-2acd-3690-9ec6-1ef375274364
 26 fce69dc1-1382-517e-9ca1-c848c0979cf2
 27 7122d7d8-f88f-0f6a-aa09-d9c9290f2dd7
 28 ecc78def-855e-713b-8d52-21e2c8746c68
 29 7811473c-5fe6-07b6-b5b8-6eabd3c54997
 30 85b70eab-6eec-6c9c-9726-796b43e522d1
 31 96bb730c-8d81-40e4-ab6e-a66582422839
 32 497cde13-840e-1b29-855b-c31cea809003

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 73312426226348381323076235070641. Exactly this sequence comes out of new Random(762).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 90 of Run 43 (seed 120,022,078): new Random(120022078), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:44–10:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs