A858DE45F56D9BC9 archive

201304032017 1bkve1

explained decrypted filler

seed 492

Metadata

Post ID
1bkve1
Title
201304032017 → 2013-04-03 20:17 on A858's clock
Posted (UTC)
2013-04-03 10:17:59
Timezone
UTC+10 · title 20:17 against posted 10:17 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304032017) = 52fac58f0f6fe215864427b288370b01 (name+title)
GUIDs
36
Filler GUID seed
new Random(492).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
16 · predicted N = 36 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FD2E4035BA6F9927 0F31DA0A7D5CFD4F 1E04FAEAD80395F3 2771E821949D63C5 54E155A3E382DDA3 F58AC53065AFEE93 C34DE40618EE282E E26B4A4A2C0F898A 903BD3FBE6EB99D0 DC3DF56393E13827 B8E9C9E1159AD22B 71B1AB7F52D2C50B 1FD8C4ACDF5C3F0E B0DC510F51BBCC53 8F6F8018F01052A0 AC2860A30BC95D85 0E7209598EE1D6F6 ED681472BEF1C104 714FAF0C49786381 03BB381471C631FE D7EEF294240ECCDE 76ACDD85CFCBF11F 59FBD815F75FF0AD 6D498108D87CEF09 22DCE1818A738435 A0A724E562D59410 122717A5272FF252 9741254DB00348F0 4E373064D9508D63 E5733EA85810E193 F056257ACD23EEDE 9C1DB767DC6B9343 03684E91A82473F2 6731E2A85C58D3E1 820FDD5D2D21E378 A0F37005BCCF9BB0 FB97A2030F2B0043 1D9A8C93D2042DC7 8D230ACC306D8F8F 589446398E413EBE CB7FD1311D51B881 6FDF2DC5FF4DACB6 55B3967743FC2BB1 670F699FB7CA00A3 D7D1B7EE03791016 0A1A22B20B776D8E 509A4FBE3950E64D 9D620CB102315E41 6201DFD97B6018C6 D04E26B1D68C4DF5 F5B2AEB22B1D65AA 21EDE4343F3D6E09 A48780FB1E5C412D 59253145F30FD430 2158B4DA66A0FEAE 847F9C38A4F3114C AFC42B9B69376992 43478B5655C63EAE BB415EFE9C2F0C08 4D6C41073BCC54AF 9FA550D9D8E61EB4 F6C627621BD5F329 5AC618C04FC86FF4 5CF81DA0DEB2DB3A 2003264A469AF4C6 E971D4036771AFC7 D46026826077889E 197F296722FAF0FB 259CF9AAC5709E0B ECCB23E1ECB4B975 264028D184E0988B BDAFA9B22832D10B E88756A54E92CF86 94661DAA1A16900D D9262ECEFC6A262E 663A6BB8CA2816D4 2FD6917EEC626236 B9601C011E759FC9 8F59D02C6120D588 17E894F09838D57B 1D9A6BF304031EE5 770137266AC718C5 7D203ED98383C1F8 19EF66E1487B41D5 65F81B6383170649 9C6E2CFE27749281 4C30B7F0A973CDA2 33DD81139B15CFE5 DCD445846C087E7A A61F9E4A197544F1 E2C1F65B687A0B49 6B62104D1FEBE01B 330FA0477ED5AB35 37AD36D86C5BD967 023C0A0FC353E2CD 639B20C52AABDA08 83232BA7A180F05F F359366C632E2BCD 40F32CE1046A938F 0956841688940E31 4A1F20353B49B2CC C67F0B561BBC4147 98A4519020C35584 4C72DAC1BB211E7C 229EDAD5593D6B02 5D67C955E7CA6EFA 3D3522C61A8A81F8 DEA5234B8A19C149 FC092184AF489E2B 03F09AE2D6BAE3A3 B585A0154D4FE8C7 ECADEB7FA45EEE9E 7EC96FBC574E32A6 9D83B404498579D8 D150917A0E774597 D940E5F0FB82E85F CA9DC8C1F2DB2D38 6053786DEDD37491 F16FF6AE09CA0191 936990140DEAA874 34C5B04170ECC9BE 5503D4B24D82EAEB 5E026FE450FF0442 8BB910906108C182 23030D02BFAEE76D 68BD4FAD180D43B7 976B3DDE4A72F8B1 CF0F59A175BA4316 458B0BB8355F7A9F DD3E720D370B8866 1C4A90B0B1042DE7 76ED660CA60F8C8D 761CECECA8B58EDB 89768B20DF960D1D 8E9DC61D154B3CA3 9CB562F546BF2B44 FCE1E1F76B61BC5D 48BDA236B6C8CBA0 7D044D241082E156 5679019D3902E321 02A0FB728075B367 9C378B91A802F598 011C466F599B8E52 5026B2E90F6D45C0 FE7A747C21951AD3
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304032017 (name+title). Key = MD5(password) = 52fac58f0f6fe215864427b288370b01, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2ddddeeb-54d5-6407-a082-92e16ebbfb85
  2 611206d4-7acd-10d8-bf17-431da2eeb6da
  3 84f8f6d9-9b5b-63d0-ba5d-381d55e56203
  4 691bf3bb-156a-50f4-a230-47c82f9efe46
  5 d74694f7-a998-3114-aef0-3f5254985eac
  6 c75e8408-6eb4-4f3a-a9c2-5150641048fe
  7 5f396801-e3f3-3718-a6b4-b37dcb06d4dc
  8 1e818ff6-56a3-2588-96a4-d31d3912cd90
  9 5ed1811d-0476-7493-8de9-f679468bdd13
 10 cb7e1ca6-6d70-63b9-8552-bc437fa37191
 11 49c1474e-670f-68a5-a42f-094dc907764f
 12 04d175a4-c254-5e72-9cdd-dca74364b23f
 13 1f4bb7a9-beb2-74f9-9552-f5566c8675f0
 14 7011bdec-26be-32ae-8f38-8cf0dd110272
 15 a79153d6-2d5f-37ed-bd96-a4230c3f6f13
 16 d1471cc3-fd9d-236c-b794-5e55b56ae24d
 17 9a4dee9a-035b-6e86-89ee-4789cc302f87
 18 b4b33710-3860-0f36-a57c-130b2ea9d4f5
 19 a6311241-0030-8fd9-8602-68f61360126f
 20 6e7930e3-392c-70ac-b1ad-ff8d68d5811f
 21 19bfcc38-9798-1b95-b86c-7641dc8dd60c
 22 4dc10989-d92e-4927-9d56-704d1a7c07e7
 23 e257c1ed-b387-13fb-8fbe-1a55517dbc18
 24 46b8a589-2d4e-8265-80c5-fbfe0cddfbd9
 25 631e40ae-059f-8fe7-81b4-e82cb7e4e357
 26 2d37f292-e108-823c-b48c-9a94f4d1b639
 27 ffc1b6e5-3c6c-8202-b864-09cab99b02bc
 28 452f8624-9c65-40be-b7b6-1e2a1ec97b6f
 29 1544321e-f37d-3a69-be84-20223593cefe
 30 9858024d-a491-2d4e-9369-6bd10732bc8d
 31 7d84bd1d-cbf8-7043-bd32-174a9cd96495
 32 a1c05d6c-f71d-0413-9d17-ec8cfac031f1
 33 fabe062e-a2bd-1363-94d8-23475dadc61f
 34 aa27d428-d102-2f18-b27d-3da58be036bf
 35 cc24d143-c766-3457-8898-e0963eb78736
 36 cda517f0-70fb-0523-8735-c1369cea9149

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 616534327665733260871418888432701230. Exactly this sequence comes out of new Random(492).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 16 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs