A858DE45F56D9BC9 archive

201304041141 1bmqrv

explained decrypted filler

seed 723

Metadata

Post ID
1bmqrv
Title
201304041141 → 2013-04-04 11:41 on A858's clock
Posted (UTC)
2013-04-04 01:41:59
Timezone
UTC+10 · title 11:41 against posted 01:41 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304041141) = 1536b55a011e5f61e85c900c339c513c (name+title)
GUIDs
36
Filler GUID seed
new Random(723).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
37 · predicted N = 36 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DE9D3A027595F98D 89C092AA5AED8E22 11AA0FF77E81BF37 C0BF8BF68E599278 35BB16A2095825F0 E4846B3ECE1C95E1 FC22EF6C58E68330 53C02D9CE4F23741 F57355AB8DA107EF EA9F5CD22FC06A6F 4AF215357982373A 40DF01E906AD4865 5BBD1F6E78BB9166 8A1803C4D4324F61 851854FFD4BB659E 16C8B6023559B362 808223A8C2CE0339 1FEE58D94F7EFB14 BA4F193C60F56DD1 105F574719F07728 FAFF631F0822B59D 8FC0165443974929 BF5CFEBD8279F477 6B1D72BACEAE5EB7 AEBA036C35C92D5C 987CC7E67A333E9D 96D4D1BB545F3566 9A58CC809A7EBBBA C56247B3057ACF73 8CA0736DF4C679B9 6F08B98CBA263122 B4FE14DD9E5F00D6 38E6A69980BC3175 B52F5F08207B8BC3 F3E3226C80D3FB68 117342CBA55B97AD 6E580913F5F1B2EC 36DADDB5AA141784 F2492A1876C7A110 C801D65965A119E1 6CC691400C4AA665 478FAE11CA0A6B4F 71D5283A55205D86 835CC0D5BC299AC3 FBB393DBAAC30AE9 C393FBB22E00BE9B CA45D27D30CA8FAC 507B3CC6C7444D14 203736D586AB8600 965F0DC8428C2630 A9EAB3EFF659D3DE 33D5965EDD937A8F E5E5700232FBE35D 5BCD6DD315B143C4 6AA2524D4F48F53B 4F14F709063B8520 C5F514CB3B81EC30 56B0780940639AFE 3655DA18F41CE4EF 7280891665C493F6 62375CC7C361248F AD46297D53AA0BA7 EF21CF0A9F40B87B 2653703AC35D5A12 83BDEC5D095CAD0E 01F9A8698D937CCB BE59F28211D55872 139C2E6413E9A6F1 5C9286547BAF66B8 7B483BC461800201 6BD4BB3D2FBA8D54 6F262E8CFA7BB36A 1EB2A0EF07D542E8 45F9AD4B12CA4EA5 3B31AC7807D9D877 5D6B0E23BF0367F8 BB12CC174798869A 9BAD9641FFA12829 1D6F1D80281EBCC7 B30C79FA6698DAEF 5337AE1C13F99E62 48C54172725D9C2F 6B9701EF141354D3 5B2E7B180D3146B7 EAEC8FD45325DF44 5A7942046E1C5612 3F8C6D2037652C5F BB6A314CD343ACE6 F90D4476147344EB 9D735683514194DC 3331E5B38E4CF1A8 4A507D3F25BA5AC2 C50C89969CDB9B5F BD7184970D63F69E 09F1EF370D1616EA 8F34FAAE3A012EB1 E28BCEB319D00763 17EF96FCEEFD1E7F A0072181043C2C39 0D85CDF3FD504B90 FE77F462BEFED86A 8FC4099071BE9C6F B22BC4FD3C0EE3B9 9763033B0484C96E 8D553E95E3C3701E 4962E3D628D0727A 87D51C88F9D1269B 1650F4D2AB3FFD05 94389019F2C5F462 875C431705E2190F 807E89EF01AB42BE 88CB1A27C062D784 911F83A95BCCC2FD AAFFB91CE5A60FFE 85BF9DB1F9B16BF2 F3A45F39039C9F8F CC62F5F7BF2D0121 EFD13FF4F8ABE5D9 8FC0D42FBFEAF418 7619B43B6D104C8D 8EEE02AAF0285F04 6EFF95EC7F12725C 4A1FEF1D150EB08A 7A31FAF5DB7BCBA8 51F0404AA88557C8 1C190366DEC93A96 1B40C7271C9AF91F 6720F99E4974DC39 3E531D1C3E0E7F84 710474FAEBEEB251 7D0F9D0333437FFF 8D925957402DD6DF 220D13A97B849DCE D0C236C36DBD9977 CD02F4131AB453E3 93945E52660FA4F6 4B53BF95C64B9207 2EA84B7C9AD222AB 3D1A3C07141A73B9 C18573704EA60F17 70C31A992C29B28D B6C6FD276699297D AE8F2F2829F602A1 91D00E245635E7C0 8E0E19B4FBDCE527
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304041141 (name+title). Key = MD5(password) = 1536b55a011e5f61e85c900c339c513c, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 240c5358-5fca-3e30-b6ca-76dd68d8c73e
  2 2bcf1085-ab8e-8479-9a17-f0054912a72d
  3 cc4dc71f-d259-162f-87f7-d535cbf17b43
  4 26eafd4e-8710-76b7-82d0-b1fcbb8df941
  5 d2e0679e-8040-50d8-9c6d-00565f718e03
  6 7743d0ba-0526-3352-8097-07425a6ced88
  7 d19658b7-3d33-7bad-8e33-b32401ac8d6b
  8 09271380-ba91-115a-aebf-728617998742
  9 1e6145a4-36de-3258-aa82-41062c6bd3eb
 10 374b7cc7-c952-78a1-9f1f-0581b43ec281
 11 1b38ae70-3d1b-81a2-b1a9-0f425c2ed880
 12 90c84b32-b99b-8779-bf40-2dd68b7d43f9
 13 7b88461b-397e-53a3-883d-96198e41d677
 14 d1cc9885-74b8-5feb-928b-6ba788f266dd
 15 b66c8e5c-c28d-0bf0-958e-91ff2c8287dd
 16 7a4a4d3e-88c2-5476-b065-c64031388207
 17 9e64d66c-f0c0-7628-aeea-fbd6cb31c291
 18 0d9c42df-bbf1-230a-8ccb-2f949d5f4d0b
 19 a5a2fad4-7c26-2915-ab68-95692873ce1c
 20 ec52b868-b101-2a43-af4b-5e79b3d3e91b
 21 e5607eb7-7354-77e3-89fd-310b3f2cd4fd
 22 40c49a0c-7310-2608-92f6-0bb2728dc2b1
 23 7fd4cb11-e45f-1c61-b26f-344aa526c570
 24 e420bc37-c364-52c4-8522-43255624786b
 25 4c8b1996-5944-582a-9df1-8cd040653a56
 26 1d180b7e-4a9d-4386-aadd-4693f9fc1a56
 27 1e01f0b7-eda2-474b-b1fc-41a6fc692668
 28 146b7d7b-1733-58ba-a458-2060c60b3740
 29 9ca05d19-71f7-2804-8982-ff17bfea5e8a
 30 0d96d460-ee5a-3281-bf2a-9e9183a73558
 31 a4ae550d-629b-0b82-aee0-28a572b9b8cc
 32 2a1d838b-6757-805d-ab35-76822ab04a9d
 33 35f765fa-8228-04d9-9bf7-8501c8d383b5
 34 314a0dd9-297a-1e6d-8f86-94ff7600fbeb
 35 b4fc8288-d523-0462-8a6f-120dddb45418
 36 c56cf226-7f77-0b08-8a4d-061378941f92

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 381753713788550572227215544523080100. Exactly this sequence comes out of new Random(723).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 37 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs