A858DE45F56D9BC9 archive

201304050517 1bohn3

explained decrypted filler

seed 846

Metadata

Post ID
1bohn3
Title
201304050517 → 2013-04-05 05:17 on A858's clock
Posted (UTC)
2013-04-04 19:17:58
Timezone
UTC+10 · title 05:17 against posted 19:17 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304050517) = f77628ad83aa0f7a03ca6ff00a73a14f (name+title)
GUIDs
36
Filler GUID seed
new Random(846).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
61 · predicted N = 36 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D99C23EEB441B0C6 58AF5D0977E366E5 7CDB94599781E5F7 50D6D9D5C3DD03D3 AED4B9CAF39BA70A B357B7CEB4CC5138 5F05EFEBBBA3F9DC 27954B1090DA69C3 658BA5E806801E79 1EFC262F1BF9451B 4623B8E554EAC5A7 9FF63A8047F2C323 EA8492021CFA2FC6 E7D66395F5E62F3B 913D0861622DED9C 976DB959FF671497 F098DA3D5B5E00B6 30DDA863D7D03DB5 53F0D9DAB679D80F 2B921CCD182B10CB 156F38BDED428803 6EA46EFD3DCB1AD5 9E3177F6D5C0C820 61C08632AF8EAA48 484087D8FA9D3604 6100A7880C489E5B E2361A2DD7C050BB 362DC4DD2B9BCDB6 F2597B897F50CD17 1ABEE6D02DE3CD02 9CCBEB0753233667 3D8B4DCFCB298ECB 6F9B6D22FB16745F 4BF3C3B58E32E988 D1BFAF8412FCEAA5 B7FA66694D070F2E 0CF110A31A2D0B69 BCE8E0F0F8E2C324 AD179CCEE406E65A 32A96CB0FD4CCBA7 4DBD7C7ADF4AC82A 2987B974200C5AD5 A8985DFAF0848E7F 42C9DF88C5D8E823 0094BD57AC4703F8 8FFDB04CC6388543 EFC6CBFDC41A9403 7FC763B8FF664573 303C7160986B1C4E 282C1347D59FE7AD BDA05D3E6D3B139F 96F5FFE7755C4C0D FBF6C31BFFC6FE89 DE97E1B636EC0591 A5DBF1BA4B15B3B9 9AFE9FA06F4BEB1C A6317F953335AD6F 723FA1813FF4037D 5699766ED3851A1B 67F02361BD0AD224 84A4AB4D169A1B71 F318A378C41AD87D DB762753C8FFF19F A6EBBDE42BE40735 D83C5138A6EC647D 46FFA5933C5D0F01 1C4CBB5BC8266E45 AA0A672141E96BB4 97B2AADB0997C92F 591049238623F997 1367775135C23ED6 23B970A48B72B66A 049C4DB2ABBC0C04 DF12E5490B42E5B1 8A845C256507F4C4 D34DDA614F38B3EE 27E9879F349167E8 693B3A6484EE4EB4 30042B5899AE0539 1CA606477BB53164 07B496139CE592A8 A9A77D4D12519B9B 3E80497ED0478080 12EB2ADA1C670098 060BFA72348F0545 DC81E2320B8EAA5E A3E518BC59B79DCF B19F822F31446EA3 EC30455305985DAD E8408396307A7179 6AC909715A0AA410 3C7CA48143A451E6 8638EA75087A887D 199E707D14CCF67B EA531ECE4782933B 8DBA53F9B8169EA0 C446BEF499465328 507153091015919C CEBCD115FDF3D1F4 77C8261B339BA90D F1884086D59E6881 8F28EAA2B09C4FEE 6333100251B2B46E 7A202615D192BCDC 9D2CFEBEDA222D5D EFA5E1B5F8E47D33 12C58158EA8312CA 6E32B0372EDE2342 26043FDB67E5C62D 5C2092EBC07C4D6F 13B696A8A000E92D E59272EE42DFD27F 6BD9BC8069FEECCF 546590295075ACC3 84C1C1EF2627D61D A977E39724C88565 9C58A3009A55BB54 2E72B726E3842B37 67D29150E77C4AC6 21B3D62CDBD9D302 3F5B3FC73731C0C8 DAEFAF7FDD2483FB C1414F4EDE287ECD 738121FDA7E3D674 A90350697C9F16D4 A6CD082099D75F66 CE9A19AD5192F3DD B517442F93D53DC6 F6A26EB8B0CADC4C 5080550DC166EDB6 46294CFB4E2F00C0 AAA371E2CD3E25B3 4B69BB78BEB5665E A8F3B398D9EA42A5 D08690F4F01C1842 C8DFC7C416BEBE5F 68F5A117B07A25DC 54DF65715A28D6C7 9B22142BF7016A64 EB3AEEA339FEEBF2 10BFE31E6110AD60 891FB32F240ADA0E 5770D262C43550F2 BC49FC4DBC545AD6 9342FF64F36DD354
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304050517 (name+title). Key = MD5(password) = f77628ad83aa0f7a03ca6ff00a73a14f, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 afb24c43-aa7f-6ace-8e06-ee86ba5b5805
  2 02db119b-6194-0319-a73a-49157438fdef
  3 7cba8792-59ee-1adf-9cff-1b03b08d39cc
  4 dbbb225c-81e9-14af-8e11-ad9f114b4a78
  5 c0e9ea36-7153-16db-98b3-6b3675d73f46
  6 8a9d1963-537b-720e-936f-c76b82357a1f
  7 b55ad1b2-b010-8f8b-a99c-a9c4f64093b4
  8 538978a9-b3d9-73a7-bca0-b732bbd4c210
  9 d2804a5e-6b40-5d1e-b725-03edf69fecab
 10 54bfaa43-91a8-27c0-bb59-5c26b8f3e8c4
 11 3a86a21e-1ba0-58e4-b9e2-7f5f63d79f82
 12 6523bf59-9cab-81a0-bd37-e4a1a11eba66
 13 dee6a9f6-d95e-10d3-af48-bee733fd9ce6
 14 639acbc1-c4a3-5ad9-b7e3-abaed9f35bab
 15 aab4b873-88f9-1162-a804-19b00f98b91d
 16 69339c3d-1f02-3453-bee6-d8d8d9ec8db9
 17 1273c71d-8db6-4349-abab-a6ffa8cac43f
 18 e8c4c4e4-b010-4de8-93fc-7ab3d57a1539
 19 c628d404-d21c-5ebd-842b-802e07394514
 20 b7acd9a1-8dda-8c9a-af40-fad585a7f59c
 21 428823ee-7385-22a0-a1a0-f4895d5f112f
 22 11dd88cb-ff7d-3a20-884b-360957b226b9
 23 a5282eff-afcc-858c-850c-073481f0a799
 24 30170033-42e8-540e-be66-6f63fe8045b4
 25 94020f2d-e8b8-51c3-981f-9957b1307382
 26 a426905b-7787-58b1-88a4-efd58d2559f0
 27 d7c71f63-bbe8-24d8-9028-b4a507c48ebc
 28 7dd2beb6-6da2-727f-8ca4-5c3ea5719b8a
 29 96fda0d7-cc0a-2510-9742-2b52579fb9fd
 30 4788de95-70c9-393b-ab62-e91fb0c40ad2
 31 a36ba560-9a02-41fa-bc82-0caade0a1ba2
 32 000b9ffc-0144-234b-b715-0bfc6589874c
 33 c59e390a-cda8-4596-8ad4-1d4af4c7d5c5
 34 a3067c94-4123-13c5-aeec-0bb02249528b
 35 ddd744e7-393f-0c12-a9e5-955dac885841
 36 9cebbd56-0efe-371c-9b13-6f48a5b42c72

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 601117875258151344582385552723424103. Exactly this sequence comes out of new Random(846).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 61 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs