A858DE45F56D9BC9 archive

201304041353 1bn15q

explained decrypted filler

seed 620

Metadata

Post ID
1bn15q
Title
201304041353 → 2013-04-04 13:53 on A858's clock
Posted (UTC)
2013-04-04 03:53:59
Timezone
UTC+10 · title 13:53 against posted 03:53 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304041353) = 5e048aeccaa73907d39d9e7ad2327273 (name+title)
GUIDs
32
Filler GUID seed
new Random(620).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
40 · predicted N = 32 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

88871E8A855ADEED C438600CB32E1C61 1C1026C3AFD649C7 4FD9AC22A5D5B691 F2421C76B0CA25B1 96EA75FF4CF5B1B6 0B19BB60144BFA31 CBD2B3B22D915E6C 8361D772682C915F C2BB5304052E8DD3 ADB7DF19324D2C1B E08650ECBEF70907 B2C66DE3A8DEE64A 76CE458D83CC1248 ADFBC4D176FC2CA7 DD2C0E7A8E9032F1 257691AD9F67954E ABB4D7CCDC34DE56 BE1D50DB5B37AD3B 3542791851F72441 8BB536F3F34CF311 9705473E80ECD8C2 378B193DE35AE5C1 8862B90181BED13F 8297F9FD8671411E 28A66361CDD81627 AD5E3CF40A0CDA5D 895797FC65526376 A22CC7F832FE6540 E4064C7BA83E21E9 2928DE33E5100F39 2AA9AFC20046577F 8ED8F873B555782A 4F02AD269F8F6223 A5BDC6509E3304B9 A45C234CBAE9AF5F 2DCA2F89894B7E3D 7A156C9F44840356 F734DD87444851D6 1A224D61D8FD288C C36D1AB16A02A3A6 140607624F6B70DD F459E5F1E4E3FDB9 EA56011DD2D08D30 16CD518BF6E0AA37 EB718A24068DA05B F488853A37B67919 96E424B3CC6E7B9A 8DF2A343AE15D6C8 B84E6D5AA0521247 4BCBEE7D3A6F44DB DFAD077C2FEEEFF8 24F522065DAC693D 7DDA566E500FBA02 032D48158418ABD3 260532FC0F687D9D D00F4B02FDF23727 F7A585B7522F69D5 131568CBD2F894E7 2E8B7EFEBCBE5DC8 55B866E1C846B898 65FE541098C919E4 B04EA2A18A47EE90 D102A68E165B9B8F 409B2C13B8E15B63 81A93E6213B4175D 9249DAE2F9AA6D24 42304C110476BF5C 318403A1027B1B55 F1126C1585480C00 21E82708E8781130 DBA10A4D68F544E2 59A615202F8F2EF1 93308A462A0684B0 2AC7A4F910408985 FFE269F9FA2EC0C8 439116A358C13D62 000EE6AF29D7A675 D68C50CEE2B81568 DE9D2096E8A027E9 51804CAE1340AE80 F3F2E4232812433C B05D301C5A2ABC3F 345E8DE7A8E327DA 33E6B3287E5F69DF 245FF3D83F7229B1 FF8CB12BE6DE4A38 9EE3D60706FDDFFB 5ADB8CDD8A0A1003 D1B161B469CAECE7 44A82FD0A526AE64 7B9FEE98CC20E943 70509AC6B5579F2C 5097EEC4020C56C0 32A3FDD7D0DA3533 E5E14F992636242E EFFD9E1FE436A814 7CE677D9811D196D 1BB22E4DED6F1453 FCB24FC42DE5B413 74147A4708723C03 0B8D3EEC2B8382AD 3AB2E98543216BF8 67171B06645A61DF 9599499088BD25E4 5C5A8943A6257ABC 9081F1BEDBA10853 A47AD9390043EF27 CDADAB231CCA3D92 83313305CD234C9A CBFF5230F072765D 7662A2D6965D8C6E 2983A98F414DC3F4 D059043107B7AAA4 6B8927A86688E864 371EDD49A4241861 2897A6FCBBF3BFE8 D90BD0949BF95F42 A8D79267B1675E4D CE9B26E298A6489F BF4BB0AD20965477 F718BD0535DC615E 02D2AAE04726EBD1 7A006A6614B8E3C1 6C0F37A60922478C B59FEA0DDC05F27A E69B45233B62EA99 D6B8DE527E1CD9E3 51A21220C96D8C75
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304041353 (name+title). Key = MD5(password) = 5e048aeccaa73907d39d9e7ad2327273, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e0144a5c-74d6-5da4-88f1-88c0e86bfe23
  2 1882a242-9e3c-65b6-a7e4-4fee3ad14769
  3 7a4d2354-e16f-1393-b23e-27558ef90e91
  4 2adf38d0-c95f-80a7-a09c-5b68b18c025b
  5 df8de660-ece5-1b6d-b29b-d57635403d4d
  6 4ba1af51-2ae7-381e-9743-b61738696711
  7 db788f9d-465f-6955-bcee-e0bb845dd686
  8 21ce8784-b2ac-4a9c-82a9-5a2405fece6e
  9 05e996a2-9c0c-61e0-9be7-8d74bbaa108a
 10 0f78577a-8622-8dbc-9dbb-69afbcd64714
 11 06c35151-74e4-0dd8-ac07-33f6d8e7c855
 12 058a95db-c8b6-4060-ba73-977adc4542da
 13 a2fc70f9-a315-73b2-ab7f-967a52f567f5
 14 755e67d2-39a6-0311-8174-fb34438a1ce4
 15 34693f26-a46a-8260-a94d-6a62c1b0cc1a
 16 7332a1b8-284d-2c5f-8743-2d1e2cd5cc6c
 17 7bdc06ea-e29b-4066-8373-f757f5cf1f2a
 18 8e1db612-39ad-387e-9f73-eb48e8ade332
 19 dbf3fa14-3827-49b4-b830-1fafea0d779b
 20 34a9a649-bf73-35e6-9d5f-ce1cd0eea75d
 21 eb617ed6-9ab3-1d8b-8fa4-cddf6a0d1a75
 22 f2555bd0-d5bb-87a0-81d9-6fa77ff83971
 23 39de03e2-9961-631f-9e52-dac7ac5750a8
 24 33508cb6-f5c8-57cd-a264-80bf2bd1ac10
 25 9e6a1300-3c4a-47d0-b616-a10c59b57510
 26 738602da-4f9f-2eee-aa6a-8cfbfab70216
 27 3023f4fe-38fc-8eb9-98da-b078cb7e1427
 28 c737f0cc-1e1b-7f06-904a-20ee644cc327
 29 39e7c4fb-d1b3-7341-8094-28193eb4090d
 30 9bf0c3b3-a1c4-3cdd-979b-6bb52fafbf5d
 31 2e16ca34-b053-08e9-9193-7bee309c448c
 32 7e64f85b-1597-6c86-afaa-fbdcd98de276

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 56181364680470824343186542877306. Exactly this sequence comes out of new Random(620).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 40 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs