A858DE45F56D9BC9 archive

201304040125 1blbgi

explained decrypted filler

seed 232

Metadata

Post ID
1blbgi
Title
201304040125 → 2013-04-04 01:25 on A858's clock
Posted (UTC)
2013-04-03 15:25:59
Timezone
UTC+10 · title 01:25 against posted 15:25 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304040125) = 87663ea8d3a62f7e33100b7a49e915ab (name+title)
GUIDs
32
Filler GUID seed
new Random(232).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
23 · predicted N = 32 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

65B21AF6C6F02DE7 0A5656FEF031D02A 489FE34AFEB7B29F A440E32D9623359E C916C23EB7325280 E7068524CDE8FD71 7BCEFB06E273FC65 777CBDF4B95985FC 06665E13BAD13248 FB756188F6B667CD BF5A81CE59D266F7 B217E977E27B32FE 61B8F3BE24A3479D 6CB7982BFF5CF323 FB29AF22E14C194D 55AA473F99D798EC 035A9FDFF8E54C7A D64DFE920152B0E9 B33BC7E90C360B04 0778AD17095A0AFE F35E269219AE0D49 DEB3A01517FF912A 2B8E5892BAC67B43 C98731A068F0C355 B53CCCB48D45D8F6 5BB628074D124BBE 75C8256AAD162443 8F90ABA5FEA86CC7 17D312A6384E793D 84FD5E275CFB66AE 3B538D9F2C886042 8FD5F271DE6822B5 1B407761E7FF1E0D 8AB1322DD9E4FE0A C611BAB1EE2136D4 39BF991F149641F8 DA20BF7BCD35EEC5 2D39CBE38CC096EC A9982A37BEF2B2C8 2EC3A62125F5BA23 89BD679BE2D6E573 5EF15C6F37FD8117 F1A5756281BD9905 24A10D72A4987D27 EDE3A4BF83187AEC 449DA8A43782BFE9 1A315999AA665CF2 8CC504D6B2A5676A 0460AA47FB1A455F DF231F03C7B262F4 7F380FD240BEF8F0 297DB08805A4AEB9 23525C8DE18DA81F 03AD2E149B3819BE 99A6D968E0016CCA D82875F3764AE770 F669BA5075A779D5 4575251E61134D21 A051E29E71FE82B9 9E2C8A41E3550A05 0F91985B6E31EE6C 4DD7F822F824A012 6F71B9A7E75B33B2 89FF6300DF6B53FC CCC6FD4395EAEC30 7DB0E38B233E8209 34CDFA4F879653D7 9F9DBACE55664D26 3CA5D9B00F402208 CDF0A1950B41C354 5745A1BE3682BCCB 194014A48D3C0BF9 4D36DD948025DCE6 7D9A0B822F994450 4719592562C5977B FE04A5C232D00243 5019D603E7F9C870 B7639532AD5EB64C 2DE2AF671773722D 303F94EF80DA9974 66B42C3114D6EA1C 95CBDADE99CB87AF 409BA4C05FE28796 0065D1710D45E185 A1221C26CFFB7A72 9797A0F45614E89F 3E8D03B610FBAD23 41AE7F45DFFCBF34 F85F638E8BF66FAB B06961FF83C0F627 32C47AD31028DA72 493B6D60173F8B35 0137047E29D4356A E66B933B2ED46F7A 2DF0AFA4BA9ADD8D 0867194FCCF2246B F131571EB1040A4B 2B125BFAFE5D44D9 B44394F1E87736C7 B3E8FA86CA737266 63CD5EF42311069C 362909E8BE28BA19 A358FB94EF90D2C9 11B162819B9A473A 69E4001A83878B23 74E529F7B1BD16EC 81D0F0774CCB552C E5C3DA3AEDBAC1F6 22A59C6399B69922 E6003C47EA849B06 CB9D103A9362D4D9 70B24B3982836E7B 6E35370E01DA6128 95EC1F38C9B329E9 E729D37AD11969DB 450F1F1A749D7D0D 26EA7E133696F7F2 C02624D031CEB9DD 0C47782D36FBA260 0FF7B091BEE8AEB5 06686F742B0C4874 DBC02F25F4BB6A43 48A9D5161F5F804D 707D561C1539E3BD 4DDCF76B5383BEA6 15C1357DB9B83A2F CCC722905E5B60C8 E00EFD1767D4507F F00AF7F8023D5283
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304040125 (name+title). Key = MD5(password) = 87663ea8d3a62f7e33100b7a49e915ab, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f317eb56-0667-8629-9a51-ab92d1e6126b
  2 0ce5f837-a4b2-8b0a-9a0f-cca952b54fe6
  3 4ec8165e-a890-8367-bea3-066fa3c4146d
  4 f528ed5e-6859-0b6f-b626-2e619d50490d
  5 a690aae6-654b-8c50-88df-03d8d2df5896
  6 16dca9bc-0b5e-2e4f-abae-7baaa0f41ce6
  7 6364efc6-192c-70a6-b889-70f3c3349ac7
  8 82446845-0567-785f-8b0e-df1523f28b63
  9 d2d6f233-1f65-6cad-83dd-a80409a4c652
 10 9da3988b-3789-7e8b-84c5-71625c166155
 11 5e634a23-379b-17a8-aa70-ccd220aeccdc
 12 35a85716-87ed-5b06-b73c-e967b82d3555
 13 86046fd4-e9bf-14cd-b890-05f6b49c3d4c
 14 e2eff102-2164-1e1c-a7c0-a981b455dbcd
 15 4d6e1840-5af9-3eee-9e71-26968a1e2371
 16 d3e81a1f-8d80-8173-8788-3456aeac1f04
 17 a4bd6072-e142-3d9c-b966-9e6b9e99bc9d
 18 7840be2c-6310-7e0a-aa2b-c5edb329e85e
 19 30909c92-b27d-8a41-be39-b6d027accbfd
 20 a86765a7-4cc3-1547-b57e-65b62d8a1798
 21 0fd48d17-cc8f-53c3-9ea0-c7d3e4118ccc
 22 fed7ee57-61d1-6f14-ae4c-3718ef501adb
 23 7e6d1537-8825-1981-bc2e-9f57cb849eb0
 24 b3945fc2-0822-0364-acb3-dadda0450593
 25 4135cfa9-3431-3ff9-b777-327af84a0a68
 26 4fd704b7-a3a4-615e-92d1-00a8e100efa9
 27 668b406f-6016-3c45-b629-08ba660f32b8
 28 a955d7f9-fc12-374d-ae84-280670215f7e
 29 47709039-3075-5469-a745-3f3cc31398b0
 30 d5709ea0-1b19-8cb8-8320-79b2dd7d0033
 31 194600cf-ea7f-7f2f-8565-b401ff2124e6
 32 c01ee7bb-3e4c-5e90-8ea8-1ec422668c08

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 88808277671511383781561036335875. Exactly this sequence comes out of new Random(232).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 23 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs