A858DE45F56D9BC9 archive

201304031805 1bkrbx

explained decrypted filler

seed 590

Metadata

Post ID
1bkrbx
Title
201304031805 → 2013-04-03 18:05 on A858's clock
Posted (UTC)
2013-04-03 08:06:00
Timezone
UTC+10 · title 18:05 against posted 08:06 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304031805) = 9c82d3ecc831c1b3d480b2ac8255263b (name+title)
GUIDs
36
Filler GUID seed
new Random(590).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
13 · predicted N = 36 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

43E85E090FC4452D 4280DE9AAA27BAB1 9A2FC0CC8F42F101 E0BC09257FB5FA75 8210FE3A42974CE8 CDC77686E61B3603 DE52F9C33FA04A08 81CE7ECDA141F12C CAB4B96F4503DAFD D59716870B5344B7 62C262A212B468E7 CFFF4423E54DAC05 0646DEC32C315559 38E5554B045016AB 85210779AECAB0F7 DD5BA5D9CB4CBD15 3ACF3E17CF6446A2 9F764DF6C5735C6A 61DA2F7DB79C897D 3D5E6AF93FDAE4A4 AE0FE612B54BD50B 284C0F9D2506BA48 D0B108C7BEBB0825 04AE485D3EE4168D 2985CB089F07CE81 638EC235B37EBD65 B269F7D5EAD45E6B 05F8C493B9AD1AD2 8E962A0A0CF0F46A 4E21C52424CDC652 428C9B68195AC32F B40547368249B4E3 46255B53D5E0C9D2 9475633F7F9391FD A4115CAA9EA1CF83 9D7B3F053A3ECFB3 D443D92F81D9B7B3 B953111F3734FDB7 035EDCE49E6C4207 64926D05448B815A D2A5BBC181D3AB92 AFD88E9072BB241A D1B5167AE99E6671 CECD31C574EF1E40 B314BE66477F7E4E B4221D6943B4631F A0020EC41DDD2FD0 FE415EF490986F5B 68AA95721DC69C99 A1DB0CA6DA681A4D 89F075F5A13B93C6 587269ED4A1CC178 DD0FB3E584CFCF4E 6B5CF7D7A5A80CBB 71707DF545496E69 35B099D8E2EC524E 3D197AB9C0D630E0 A8C08AB2DF1CAE9D 5CD1072CCDED7C4E AE44C262596C4625 5B35AE12400C86B5 CB26E95A3C490C00 CC3A23CF901F3A10 08FD4CF10BA81037 026B4638C65A554C 73F8E2CC37DF0899 A908768E0A0F3298 D6621FADA35F5127 AB9D433D962292B5 3B1337F88691421C E69C86EBA85D0C18 4E85D4FCE0D01DE4 2D069954BB2E4579 A4035788BF97E706 89260690E381D087 24BDEF24F0661C1C 34EE83CFE4DBA9AB B2938684C9DF6A51 54317FE306044140 821ECAB8F8805F9E 17EA1DAE6D6BF2A4 CF5702B3C14F2045 E385E71E54A18A8F B1C4AE19C70AE0E1 3BC4B1DDD52F54A2 FC2AA78A8D6439BB E7DBE907DFD4AE13 5005E6AE9F060FFB 0B743B94CF705595 A5D4D7046DDFC4FE 23993DD652659D33 0DDB6EB7A4868CDB 8BED01A798D2280E 9DACDC9EA9A0EDB2 CD6E222DD31A8B02 DCEC61A86DD4253F A7F8F19787D7601E 02A4BFDF165C012D 7FB23F21E470B7E4 4C255AE7D7BB362C 446D0F3978072E8A 01F7CC07F1F2EC63 63CA34341832BBCB DEBDC8912688FF61 2D48693AC53A04C2 09DAA4DF89350C01 91BCF94CE5513516 615A240356A27F04 6BE805F75C8ADD58 7192B7FEA0DE2AB5 1E9AFB875FDDDA39 C0F487E1112B840C 86DCC9107D965A48 CA80B3DA05DD1A08 53A148E3BF728A19 67F587D1821D0CEF 0A45B9E75CBD1C4E 6FD7FC443D17A057 C6FEE90458485C76 337C8A609DDDFB52 014AEC94C6B64D8C C04606A9F5328762 70656B63C414C7F2 6793A62CAC63FF77 77D1D8B13B39C56C F31C673E7B8098AD F19A2280A00E0B05 B90C1195638F39EE C9A6B037513E5333 3E7B94512E4E376C 58392E917AB4403A 7AD60B1456F16FE1 451E4631FAEF52BA 60B721850031F25C 667EE95805B24A77 011A0C8E75BE90AC 9DDAA55EFBE40F00 4078D864F41C4CB1 232600DA59ECE582 D5C524D67CDDF991 1EA13D53A87A727C E5DC9CB2F5606000 32E29E58B5107ED6 26734820B3514DA9 BAB4464265D0F487
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304031805 (name+title). Key = MD5(password) = 9c82d3ecc831c1b3d480b2ac8255263b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 28d73b13-f21f-8381-b7bc-edc3b00e9d83
  2 7c5634ec-ad61-88a0-b31d-538500ca95af
  3 4b6152a3-e921-1e81-bc11-ade9a268b4cf
  4 8eca0a9f-ef9c-474d-b113-8ddecaa8d536
  5 069ddbd8-2aeb-5ec6-93d1-955b09623135
  6 a387b7ed-526f-1a05-81ad-ff2520399cb9
  7 8ac0d457-ca0c-280f-9063-cfe303a29ab2
  8 5fe81276-eaa4-3480-9288-25792cbf8b89
  9 3d68a7eb-bc6f-8fff-9109-6b5b7ec1521d
 10 43663aa1-262c-706b-8517-edc9079b4cfc
 11 706b228a-4f58-8716-8318-b6cef19df8de
 12 bb847722-1758-0ed1-a269-8cf546a9b6df
 13 d2ee995d-f778-2fb3-8002-8b5d14828eb1
 14 cf69c63d-ca17-3c73-8b14-9f1b95dceb9d
 15 81eee4b3-a7c9-8592-94fb-f9df4cbd14f5
 16 25c337c7-d840-434e-8b4c-2fb524a52d11
 17 49c3d1c2-fde5-7041-9fd1-fde0a3e4205e
 18 706f5998-f6f2-794e-be0a-f2e7ecc7f69e
 19 3b302632-dc12-595d-ab0e-837306ff1e68
 20 e14edfbd-949f-6b01-b202-087de1971b7e
 21 3656b9a9-aed0-1a4e-8a14-9ed7046064e5
 22 b0417133-c896-50f9-8270-215ceb705653
 23 781b6ec6-7013-6cd7-870d-7fe17e7042c5
 24 86290c30-7304-1f95-a9bc-a55c446a3f4c
 25 f8a3b01a-7de4-4569-87b6-f005c149366a
 26 d6e95b2e-9164-019d-b539-edcd1a8ea236
 27 de62e60c-34d1-18ce-8538-d304ea514fd9
 28 27d898d3-04d1-223f-8762-38d2254a1a2b
 29 34a71885-01e1-4cf2-8a1b-fb2f0b22eb0d
 30 f41e1c3e-67e5-2f8e-9eb9-1f834e574b97
 31 acd3bdd4-2ecf-05a8-93db-cbd8c63f58e5
 32 ed09d170-c7d8-7ae3-b0e4-222cfd6e24bf
 33 c4784deb-0426-457a-bf84-efe8905cc6d8
 34 0885de36-0e33-7898-90f5-5784864f9445
 35 e70911b8-cd3a-5377-a6d4-8a3f32eb1590
 36 0ea7df7f-a221-2f16-bd55-087146bef143

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 881451238780238477561561401242074752. Exactly this sequence comes out of new Random(590).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 13 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs