A858DE45F56D9BC9 archive

201304050009 1bnt0n

explained decrypted filler

seed 126

Metadata

Post ID
1bnt0n
Title
201304050009 → 2013-04-05 00:09 on A858's clock
Posted (UTC)
2013-04-04 14:09:58
Timezone
UTC+10 · title 00:09 against posted 14:09 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304050009) = 1f3d92ccbecd77b281072b333e5a6099 (name+title)
GUIDs
36
Filler GUID seed
new Random(126).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
54 · predicted N = 36 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FAE6EC564F106935 34C66D0857660353 1D0F7495F6CBD3B1 FA130C613A00B489 BA1C45D4791F72AD 6A3E52F7762C1A8B BD9BE932E2219D15 0234248EA7D4A0DE C40B4670DEA48BE8 74B8EC221FD13ED8 4ED230BBF75E3124 55C995E7A474C2F6 FE230FFCF5E4CCC1 29FB275988499CFF D78DDB667DCD0B4B D68973D7869B8C5F 874A6C04613F29C8 40E54063A8839FA9 9E466D7072D6C802 5BD845D15498E74B 2F50882643B6441B 821D366F8D43C3D1 F9D1CFCB31615599 34BA68504A0D462A 2E5ABD35E7423D1C A2B7BB1C47085D54 FF93B7609735EB27 F6067C994490BC80 29514D6C0CD5AF87 46A5264148F317E1 F65FF8A9DE253EF9 21CD4888AE8CE3F1 640AA40DD8F015A1 361C950760683476 8EA0EAA5132110EE 195637589F7F778E CFC7554BD680C11A CF346EBFAEC39A2B 0740B04386B049CC FAA67A37F9DD97BC CF57B7EF9BFAC081 BAB931FAFF077804 0498A4CF636054FD 9C8FEB8A938A8865 02EB1A2B40CD5D33 2CB95ABA817C9C39 10E0FBDCB69D7360 C74316481E7E6BB6 CB65D97CE11E0215 6056D8B15B3A6471 00617BFE15887945 E9BFAA621FA5BD4E 703D8E1503B27C88 61721DD46253413E BB90A69DCFBCEFB3 3D1DB3A17D5BB809 745E83E5A826FADC BAA56D7DB15F8F3F D2E23D441C5F6B2F EF82E5354533BE4F E5FC0D0E71E607D3 2F3F0D8D8C1CE875 8F1FF4ABE73F1D51 77704243842E4B0C FE08C5735C183EF8 9A3D7B857FCE56B4 CD9F5D2F5BD187D0 40D51E17065043AD D135F37CE3FF40FC 1744A946C42722F5 3A666F5B6DA3E376 B3F506011FC08E01 357B1C25FE0ECAF0 CFA2FE9FC5DB57E8 A82050051EB0B43A B3C90E418081565B 41E2E1EE0752D6EB 284EF1D7505868B9 CAD496FBD98FF1F7 711E69F0404CDC25 E458D4804F524E27 15F403A0C684D72C 2C5B2FEC4F6FC439 817C8BC486ECC74B 9B2F7D2703625665 9AFA0D3700FCD073 1737107F767F67B6 FA113E62486F2998 280EA419FC6CAD91 087990403B394F2C B34675D2F0A9AAC4 3E1F91B93A655716 BE7314AA55002FE5 817137BF36B6E781 664A9A0DBDBF6FB0 71803B88A0F96F5B 3B8AA04D51334061 6A7E62638CB08B1D 0D28B294F014734B 210FD32F9F73EB6B 04D33E249A964200 61C7974CDEDF26F1 3D58F65D9399B6F0 C8863EB027C443FF 1B49FB31FF024A04 D59796B1B032CDB1 4B21E5E1A4B68D2C C3F7E6E426590961 9C1D0014E4381E21 BC581A3108C95C0E 5AB5DC779D5EB2A3 CB81094FED4CC975 5D04A49EE672798B 88EE713EBF61DE33 89996D9C2CF91BEF 1095CFFE74DE534B AB608999A9B60CE7 93C1B41FC6BEE4D8 F0D8705A33561C73 4570324EF8BDAF80 FF0F142B0D9090E3 02A2BFF153E65415 D509F431315325F1 F638A32B5DB177E0 872F4DB813D9478E 3C3DA460B2021C67 B9237D9206049CF7 C803D5A1CA2375FC DA35ED545E83C333 3A37F309C759F6F8 6CABFFAB01F1C413 A4B5CE45C6DAB5CE 8828440104AFABA4 CCF6DDA3334EB455 E8499A85BA6900C9 33AC6FBFC344BA35 62F636DC8C85E5F0 E00CFB12528FF4D0 9E9DD9FDB7566E46 266E1501027E7C8C 1DFEE5EF86E73000 DAE6400C7DE5E0E0 3DFF96E17563E07B AA293001161E2ADC 47DBD4928F800848
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304050009 (name+title). Key = MD5(password) = 1f3d92ccbecd77b281072b333e5a6099, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c465e8bd-a314-47b8-9590-9722e440fac7
  2 cb11d600-ebce-7335-9472-d1bcc317f35c
  3 ee2b3a48-78ce-767f-b72d-1a1e3493e277
  4 87b61653-4948-40c7-acca-934c5a90bd91
  5 9738fd6e-b2cf-0650-8f09-1bc8eaa1047d
  6 e2ad5355-22f2-68dc-afaa-7854dae7f05a
  7 2887ef49-a599-37e7-872d-4a3db56ff4b2
  8 3282bb68-63a9-5171-aefb-32c9159502f1
  9 45b11923-38d6-5679-bf62-83cad2667318
 10 00311731-c052-633f-a15a-9d9e0d7bde19
 11 7a088a60-3969-12c0-8fa9-26597a8bf85d
 12 7a3d2d9f-6d28-71d9-a25e-f82900681837
 13 b6be7a56-214b-2191-84d0-19e450d7b25c
 14 fe4128fc-263b-05b9-9255-9f4f4d44a357
 15 4bd6bfaa-a6d1-1789-ba2c-4e6cc4cd3134
 16 c70c292e-1c7a-6542-bd71-759446caf0cb
 17 fa48e018-3f02-76aa-bb46-6933d0b4087d
 18 2463bfef-3906-17de-a9f7-eb285fe340f9
 19 b6e791ca-5659-0b54-a12f-4725d7c33468
 20 2d58a911-bbc8-0937-b64c-4b0482eb9b35
 21 cbc54a60-207b-5d08-a1ee-b212467b5143
 22 3ba32b52-d00a-617e-a46f-08a40f8ec755
 23 a6a48518-0a84-21f2-aa44-16aec58cf285
 24 cc9ef0a0-ea22-0a77-b763-c79aae7c8cd2
 25 d02fc890-5fbf-08a4-b2d4-08fb477e78e9
 26 fdf5b804-eee6-5db8-8419-6865f45b7100
 27 657830bb-5142-27c4-9b95-2bc7a046ee63
 28 5a8bc84c-18ff-66be-88fc-6c2f11282386
 29 babc80aa-e214-331d-b3f0-5844f24111cb
 30 128e9b43-5620-5c4a-99cd-6d4af509f64e
 31 fcdec15e-aefd-6487-85c5-587e1c18bc07
 32 5d139fec-e952-52c0-80c5-2878fd202823
 33 148ed236-b157-86f8-a75b-9caa305da154
 34 bfbacc47-536e-1816-b2fb-393849ad4a0d
 35 256f3fa8-f86f-5887-8f15-d8a3885a620b
 36 4ed514a0-89ef-2b9e-b72a-2ad70939bcb4

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 477406355617201671005620052635658152. Exactly this sequence comes out of new Random(126).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 54 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs