A858DE45F56D9BC9 archive

201304031553 1bkly6

explained decrypted filler

seed 707

Metadata

Post ID
1bkly6
Title
201304031553 → 2013-04-03 15:53 on A858's clock
Posted (UTC)
2013-04-03 05:54:00
Timezone
UTC+10 · title 15:53 against posted 05:54 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304031553) = 64a9ef629bd55204242d08a4d6ae1674 (name+title)
GUIDs
36
Filler GUID seed
new Random(707).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
10 · predicted N = 36 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5F3DD00D11AABD71 364161EEDC20CB89 5FDE738804CA738F 52D7AF6A81F26248 0FA60E418774BC49 2DEEBEA127AE03BD B7C0F993C8FC6385 E985297DE0282825 721DE0AD98801147 B6814D33033A4632 B1EA552CB53A68BD 8E076795BCA4E306 5A2259253EA3BD86 41A7268D25CC7BF9 A96387CB9C55A1A5 1B5E7CEEF9811AC6 3EF8E6AC7A31EEF3 B4AD780FB1474F17 C433918D7DBF3F48 9821F473189DE534 F600012953388D00 5380FA43F60BCE0E 3833C3C0A26FDBEC 3AB3DF26A02B26DA B967F37DC35001FC D90B9B16625A2C1F C5D57D434CC730BD 4A4B2AE725493230 86AFFC4846484E4D AA847DF70AFAEB34 CBE47975F054192C E88E329675BD24CB 359512A543F94EEE 403691E25F3F2358 E6F867F1363E1FCA 655FA70B0CA42487 5B6E2F1F865CBC1F CE78735165A6A954 2BAEBFD24C585675 EBF43F3E34F4FDE5 1E967B515BB2F052 F457CDFAD2B90EE7 C0A282ABA55CAAB0 D8EF8252DB317F69 AEF545AC8FA2BA8E 64FA1615B273C807 79F6801D150C3AFA 959938ADD6967B8B 915664AF56EC2A57 2181D4FE377B9785 9B4996BD8EEA19D6 BA9F6F4B686E908C F951BE6847D6B64A 8AF90212C60ADC94 37F5064657C7BEA3 BBDC1AB3EAD26D5E C512F162BD184726 32F7BD141BC08D92 27F152D029426F18 E3C409844D205D74 F61A6F9A1974FB4C 1E4B6E9F4A3C6E28 6BF0F2EBBE6E5AD4 3E5EE60A25ECB969 95F9F9696638E1FE 773982B52F620E04 15CF1997DA807ED2 8641AAA713282FD9 84AF73673E7D35E1 B4DCC7FAB60FCD76 240C6C6AF110D42C 163FC2F6171A7A48 24637B53D517DBE4 1B6B3EBAD60A1CC4 29D5741F138F6136 ECF59102D394D74A EE8C889425FB1B22 0E9007EF4DA47324 EAB466902B4D139C 2DB0C5EF5B314E55 7997AE10308E5B19 DD189CD6FC6E67E9 C689CEB8EEF5A2E2 8ED414986A3D7EF3 4F3C15F44CB85EA4 8C9A79D7BEFD40E9 4F907098D54E87B3 143AC02954213931 01712001C34E0273 68026456F65EA182 7266BBE6ACB902FA EED2B0A2F09C133D 216CE3D009A524CE 5FA92F98D4EF3C04 F3BD1FED7886556D 4C4DFE0933BFC7B3 30B3F6F4D5A4047F 4DD2EB0AC6355A09 4CD6DBD179BD12D3 D72D7BC21BDBA6D4 B8D0468089BAEB33 85E4E1D8C7B84CB7 9AA23C48730B0E6E 868C5A3A2C4CFE39 C97658BE18636027 CC268408B7752CE5 5ACF1794631246AC 6F3A79EA8D81C18D 5A3C3714B780EDAA 6777E45AB8A4A4EC 8E82474C6CD8C414 F31A1F29CCFBA568 32FA799AABBB9997 8C24A5971464C0EE 50837B2894637A91 0D322E932BE09063 34BDC2F1EE59E52C 38C56BC2AA061EFC 426CD5B195670846 BDAEB4E9612B31C9 32334EAF1809CDD5 DD6899AA830616F1 813873A83C1F0068 B8687C4B3A0AA18E 2A8E98032A3D0D1B E34FBBE2C597978D 9E8F7DFD7B7F7321 4567FEFFCB15A349 1D69ED132CA14110 39491628EB4B3FB5 39EB91F0C7F021D3 E3565C6CC2C5A021 B37888E29EE335F0 081A4BD7E2452247 B4329C85F6DE73C6 86D9DCBB4355FCA7 A3797C407FA6DBF5 44EAF02E4A025E01 357A9C2511525BEA E24264276F8348D5 F84442AE34BCF623 F7EDE320C6C7687C DDD83D4A8E424ED0 61170FFA8A671365 98E1E632BB97B432
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304031553 (name+title). Key = MD5(password) = 64a9ef629bd55204242d08a4d6ae1674, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 103518b6-c97b-0350-91d5-7d74c18ac2e7
  2 d34bdb62-22ef-253e-a0c8-8b37cb6d46e2
  3 c9e8b5ce-4224-8295-aed6-926bd15cc62b
  4 19f09001-219d-49f1-a276-85a3c5aebe6a
  5 1a303782-279a-380a-9e85-8463fa90b7fc
  6 9ff542d1-09e3-38c1-865c-fe5399e956ef
  7 8f0615fe-f6d2-64e3-a844-4e281d680cd3
  8 e0d2cb67-27de-1b0c-9b43-419caf2d4b41
  9 44049ed2-7ec4-408b-9147-b8c8c752f925
 10 0e26b84a-2ae9-87ac-b0d2-bdbdda4ede49
 11 844d5eba-cb6d-1498-a79f-eb624ac50a26
 12 9d9152bc-b6eb-3b13-9820-3af495102b14
 13 a6834e32-46d9-5fb0-a700-175484dfcae9
 14 d47ac2b3-de60-2f96-8456-5e566e713013
 15 b35459f2-b7ae-772f-b8e2-d05af0fcfd3f
 16 070f518a-7df0-595b-89ac-f456e00caa63
 17 f1976d0f-9e03-0fa8-baf1-f63dbf69abe0
 18 e948d9c5-7ad6-3891-bfee-a13061b9cc78
 19 7da48728-94c0-774b-aa0a-cca53c75ac46
 20 491039f6-bdcc-0751-ad7e-f7877000bdef
 21 0d80d2cd-4d3b-663b-9c2c-ca47cc3d0755
 22 f01fe801-fda6-2808-bf34-6d2abfd8342e
 23 f5bd1da8-5057-44c0-9c58-c7b81c1e9952
 24 82fae22e-9690-0cd8-a425-566346d23d3b
 25 f4ded42a-066c-8f2e-8022-b461ab284bfb
 26 51afd3b0-e6ff-2f95-81a8-73c72e552cea
 27 ba3337bd-fbfe-7bb9-bd74-b5ed5d14660d
 28 96b4b8d3-a4ec-6183-8a04-13fc7567573a
 29 c153e59d-502c-7add-9eff-1494a6c1ab4e
 30 f2a3d454-1703-4742-bfd2-750bd4805063
 31 da9dcd3a-eeb0-164f-82b8-9f89c804f5b7
 32 dbd2ec00-e45f-6358-95cb-26459e2ee4c9
 33 74d6a6ab-79e0-5a22-8188-a0ea4fcbfa00
 34 3e94b4b6-cba9-68c2-b222-306c00c6440c
 35 e883fd80-79db-43a7-afec-2a761404f360
 36 477d841e-3ac5-396f-b821-7c5b0d94fca8

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 028433614813527503706240827674165643. Exactly this sequence comes out of new Random(707).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 10 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs