A858DE45F56D9BC9 archive

201304031045 1bjzqh

explained decrypted filler

seed 859

Metadata

Post ID
1bjzqh
Title
201304031045 → 2013-04-03 10:45 on A858's clock
Posted (UTC)
2013-04-03 00:46:00
Timezone
UTC+10 · title 10:45 against posted 00:46 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304031045) = 3ee964dacff858fa145c1c3da1e1b414 (name+title)
GUIDs
36
Filler GUID seed
new Random(859).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
3 · predicted N = 36 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

919792143C69E9D0 04383531EBA28E87 51A6EB4F30F6E9F6 F10D9C70C34C66AA 1254B96605E98DF4 6E0F5270B5559EC6 EBE1E1EE4AF6525E 7899A37FCA182BED 2075AC1A6D8E5B92 7BC2C6EB7579037A 56FBBE802662D3F3 0177A9B9E90A7EAF 5D74A32C88CE75FD E1D309E03CEFA495 AC2333C666B2B3EF 481870E591F109FA 5BAD409C0B1236EB A75CAA8F9460301E 36CDE8404904EFD1 136701D48FE991EA 991D132593F6CCAC 7B60AAFD7C8C776D E2454947A7876CA1 C0503EF98D4F07AA D480AB48D434FDAB 89E5DE9F94FAE77E 72D579E6622C89B7 B392581A436424A5 CF81985C0D540621 ECA610C28316F259 286CD672BC9A0823 FA39D56FF6D5160F 36EEEEE51176089E 68F016BD79E9B5CC 7C18057F794D2D1F FDE9632C32E97DF3 7673BE802DE054AC 3EAA2A770DAFB25A 92C251FD533C89CF 920B54D274258D06 3FBCE578012ACD2D 68BF21B473FCB3D6 33DEEC6964647A73 65B2B706F51A7076 7A5C9742AA79088D BB7F024D8D0FF308 AA3198D55ED779EC 1D311571706CD19E C136233EED9BCD9A 8C208C32FEB62B6B 63FBE4770AE66669 66293853EF254603 09B2CD663ED703E3 7BE86F62C6B5D984 BC134A3D10913548 A79D2DEDFD675BC8 01DC3CD57D9EE665 5584A61C51CED6D9 318D585EB75F341A CB35B80E9921D4F2 76B8830D0866350C 3EA2E70E0597164E C889F59F316CB8DC D9EFF9BEEA3F4A7A 98DBA2BCB15C4A58 0A2F8A90F7550751 5EEB1C5602CBA90A 84AA1727FB8DCBF8 1C128F34F455EE53 3E32B91CFA2C2792 22B404415E895E1E 8A5CFF392067B3EB 4FF853170F48DD27 E27DD4841E52266F E4349EEB87E7BF0A AD076C268FBEB0ED 9C8AF68A084BF4D7 46AA7D923C7BAD85 074C48FB2D02134E 8D04F96BDE512687 796215205721EB4C 30A453DE73DF6C77 2BBC2A424905BCD8 CB02C5CD2283B60D A9D0EF350BC031CE 4130D71A91470BDA 53BC1BAD62B9DD4B 76675B1364D5B66F 01BA418C66614686 10939C9FFC3965CA A8D1E43FB21E8E24 182506495DFDB51E 7A85AEA3D7507CEA D19547A110DC5849 1B4C824AEEE0F4FF CE86C21589E7C33E 5C05242D3A79F0B8 20C12334B4876496 384FFCB18BCFE48D 05EC7DB3B3CFDA1E 60E711327E4C2E01 7C1B13C65BBA1496 C400E831639E0886 A634C8C0B5AB6AE8 91FC011098D3CD99 6A98BE9B6573319F C18D6402158B87B7 FD7A942A3274E79E 2A0F1471784D099E 4074625B09FFB0CF ED17F2C20393221F 096186924CB0D57D F6F08C0356F633CC 892FAFB3123B54E9 2F149FD536091FBC FD6CBBA6160F3253 409AF73A0231D5C0 5125517E3733AE20 751A315EA3B38DBE AC7D20BB75535730 1C55EDB07DB1ADF4 D856ADF99883E410 8ED12B204BFA4981 FD2030A95BAD24F4 67FA22C2471A117B F717F5CE6C2DD06E 8066BDDDB3FF42FD EFE02D975A4AFEFD 19F76CAD9615B13B CA69D47128C2C3F0 CFF43FF298D8C4F7 7AACC8A83950E413 789885393883A6DB 2B25FCACFEBBD4DF 5D616BC00119528D B790C176899DC417 A6FBE536C0DF2C6A EDED498738651B64 D7FE5E317AC027FE 54D0E80561D3509E 4AEA87D34EE107F4 6E7399D12419D749 AF33281E30EAA34D 086D3453C92F7C5C 2966B7017EA3941D
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304031045 (name+title). Key = MD5(password) = 3ee964dacff858fa145c1c3da1e1b414, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2fd6f9f6-d10f-4ed1-8eee-bd6c0186d0d0
  2 ff650bef-1f99-79d7-ba25-1a30b015d981
  3 a1104d9c-9aef-191a-8024-6064e6d92259
  4 2d15cc78-66eb-8093-ae07-c14881b7be2a
  5 ea37e251-0b02-017c-aca5-88275f3aac76
  6 b85a18b4-e9f8-2e84-bf02-40e5146c4b6d
  7 7f4ff2a8-4006-79d2-9a98-42852eb865e7
  8 78104bdb-4e79-36f9-98bd-751ea89513a8
  9 fcdcd81b-95ff-2f40-8cc0-7802c79de1af
 10 56edb887-86a2-0a40-adb9-7e13ab60a147
 11 0e11440d-7a10-17f3-b1b1-d99013eb365a
 12 e2a1b353-9123-0ed3-9e2c-926682827d12
 13 e7ba6761-46e4-1680-86de-3d9cdfabc7d4
 14 9f266dac-8c71-3d1d-a105-da25e389f796
 15 74dd0e6b-5fea-2559-80d3-fc28af40583b
 16 4e4f0f6e-9513-4890-8ab5-1234cc394ff6
 17 8e47d8f0-ec42-8b94-bd78-e31fb071e3fb
 18 3513ae5e-50c7-5cf9-aca6-44ed01a2e03d
 19 334a7bbe-d05e-8059-a7ab-313268db10ba
 20 17d52ee7-0e23-8b5f-8176-ffd1a3b15802
 21 4956bbd7-e5f8-801d-a044-1e3691f9857c
 22 3727dd43-4256-57df-9908-fb1145aca9f2
 23 4622425c-b6cc-173f-a91c-8685449c881b
 24 29c38a87-4e17-125c-ada5-be926cef33f4
 25 1958d2ce-9369-7491-81fc-d9909f369b7b
 26 126e9c41-85ef-096f-9f15-1e422dd3d872
 27 77c85114-2927-489e-ab1f-475c844450d9
 28 2210240c-0029-8b44-856b-7d503368f36a
 29 82ad20c0-bc36-7b3a-9d7a-b92e87f208e3
 30 8287f729-0ac2-7ffb-8a9c-d473c20c802f
 31 42433754-ed88-202f-8388-d6623cb89cc1
 32 ecbb7ab9-deb5-6b44-8d7a-71ec37329882
 33 465e0e02-56f0-6e9a-a8ab-ccfa98cf5443
 34 f46e240c-cf5d-46ad-8c91-27a711946b8b
 35 73f80918-bd5b-591a-935e-74b2b6449221
 36 e9109b98-8bcb-8475-9f7b-3e9d73172a86

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 471802732010132485888511704877266458. Exactly this sequence comes out of new Random(859).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 3 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs