A858DE45F56D9BC9 archive

201304050601 1bolq1

explained decrypted filler

seed 802

Metadata

Post ID
1bolq1
Title
201304050601 → 2013-04-05 06:01 on A858's clock
Posted (UTC)
2013-04-04 20:01:58
Timezone
UTC+10 · title 06:01 against posted 20:01 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304050601) = 42b34e869a2b503a525d35cfdd2e0634 (name+title)
GUIDs
36
Filler GUID seed
new Random(802).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
62 · predicted N = 36 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 3
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

BE1DE3812955086A 4336D63F64499F1E C838FEDEBACADDFE 36A13FCB6DA6CE69 DB42755B0A586BA3 2E186D01CD7A2690 E30B1730B728BB2D 2E3D122E43DE24E6 9375B908A6468FC0 9A97EF4DB569D5FB 91D97382A0F820EA 0509A4CE3EDB45CF 4843A7145BD38883 D5AAC728760B1CBC 9B58BE9DA33FDA95 B7C53C1323BF9B2B BBF44D42EC744FAF 891F4A8DC92DF697 899FBB16F3CF3C84 790B1E63AAB06C10 1A965445F0D33A67 A640029E2C180744 30BE0680314D5EF6 C021C577E9BC6F9B DB72D81139612848 C1A82CE0F2108D2F 6DEA6A12945B8213 BAB2C2E9B6280B5C 7973FC1DF4E91E2E EC3C48298A2D30B6 37B63BDD391C476E CB10E6BB73FB3661 0948D98BD8A12B17 E9B6CC8350710709 6EBCB6350FF4C787 B773CF99DE6CA65F 07447F6756615C25 FD2942DFA3D0FAD3 46C1C67B333E9DFE 0C6518B34AC905DE AC928071376C8008 9C4709754B769028 1BBE09746F51A631 17C72B102A8A5387 26088CEFE2014229 904FE63914D58C54 5942C8F4DCD3BF6C 0A2BC56014E02D44 D2A20F73A7E124E2 A2ECE986D15B04E1 F942B48437431247 FB63EF809563EA98 D739C1A27EFECC56 6480FAB3E8A25912 ACB162DD8FF24FDD E905508090CAF004 F8B014BC6509BA74 C5BF6E0602402CF6 A75B1625FDEAB2D5 1DA10D5209C4A6D6 D4A00088FFA08508 1BB48BC50CBB4C8A 1621E08650886904 18D9276FA99F218C CB83B17FDB1CE040 1C47FD7BE14219AF C0A263F615386771 4E1FEBD02D1D9BB3 63DEAB957DE3DAFC 82DAE01FEEC718FA 7110F07EDA490C43 6BF15D46916F4559 D270891E33DB4404 C2EBCC1EBCD405E1 A97D6C7AE21CE186 2C6EE543D1F9075B A0AD695B2F5DAF46 9F2504C0D96BF4BF 64E07A2892D01236 AAE15A17E6306256 9F723D1181D5FAE6 44110E23A4ADAE47 50FF18E7DD7AB4B8 6FBB4212A7E5296C A59F991B842907CF 87232DFFA7444E9D 00CC54D900754189 EC7127F9CD1ED066 C7A2298F510AA9CB AE2404DB85B8CABD 5CFF1264270FF484 E1AC9402C17B8FD7 060F0DF760363D67 4E18B75CFDCEF98A B745787679BC5798 50E8C95DBE167953 898533D281C0063F 20168DEDDC0B7ED5 A2BF119FF3C9D144 4423761229271714 66A3ABB871CC35AC C659F695F26FE13B A42230D72E59FEAC A95D936C669C0E4C 0AD3083F953D0E58 2838DAEF3AFE091E 2C81FDA9E2796971 88FA4DEA9DB8C3C8 924EA99DB67046DD 6538CE1FD12F8A4C B14AA42B15551150 D21D288EBD70E7E0 659872915A57A85E 9B553B168A7CEEC0 315F42628AF00DE9 C60D7FD37254999E 8E0739A0D19ED1A7 5000F8B0E5A7BA85 A842F6D13209647D 46F1FC3B3F6FABB0 B04B8BD4F31490DC CB634672B546E52F 87863D291B7D8F3D C33042F025E1E776 6FDB090DD22BE66B 1275924D6128BD69 CB097E947905F667 1943E59CC0D3E887 D2356A4285A3D6DD 2E342D5A52FF7BC4 5641236054F986C4 33AEA2880A16E7B1 C1488377EBEA5972 B9B65F445317A226 9AF3ECA633455E32 B0CAF79152E98953 34C8E6571619880E D80E9296EF8A9A45 967232A923275CD5 4AAF187487671B63 918C7B35F3AAD90F 8A7F91FB739B807E 615A6677975DA2AF 6BEC739960D8C64D F3112A308ECC2FD6
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304050601 (name+title). Key = MD5(password) = 42b34e869a2b503a525d35cfdd2e0634, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fc212976-c140-6de7-af9f-2fc9672cac2b
  2 8d6e0cf4-4d9b-14ca-92fc-a773f51944fb
  3 e034f8e4-f925-3d2a-bcd3-d82c5b7d6ecc
  4 0d0ae458-d502-687d-836e-6b9affca3190
  5 e52c9a27-2c7f-2b1e-b164-025e73189663
  6 d3c0a068-dbc2-3944-91e9-43d11636b479
  7 43e82c42-a049-2427-a4d6-82f8fd795a15
  8 7c38c95f-4491-770b-8036-2714c1070922
  9 8bf94865-6afb-1ffd-a6f6-8b8d2e031ba9
 10 568e9634-b2e7-0e89-9de5-022637bfbb2b
 11 6590ba16-e1d7-16d1-b8cb-22499d6d5638
 12 d8fc1701-4ad9-5785-89dc-f3c2c2a45d3b
 13 2cc9c1e9-4edf-8d8d-b19f-ed1bee4872e2
 14 d4be2dc7-c87b-6d45-a457-f15a6a399a5b
 15 2466a7bb-c228-3c6a-8ec2-13c2a358be7e
 16 5cde122a-c7ad-86cc-9f9a-c58b4e5278f5
 17 c8388e23-4b81-81de-bece-ce2dfd4e63d1
 18 23b7c5d7-cf44-2a94-8428-5a2223f2b484
 19 5b76b42d-68a2-3c06-a3ee-f606ef743a68
 20 9b627ba4-5317-7511-b847-8b8b2e120cc5
 21 c802586d-b47d-334d-a544-a35d395ab195
 22 9a89d1db-18c6-5471-8d4e-d288717345b7
 23 6f89e900-de67-4319-a77c-d991c58c4a07
 24 3f59518f-7606-12f0-975e-a2b9d43c3038
 25 9b42792b-f8d2-2140-a16f-c9c653bf8fce
 26 593ee481-12f6-34b6-8a54-e98ae824e0dd
 27 46c46fc3-a5e0-46a1-9cc7-553350dfa8ba
 28 cca99a28-c72e-5a96-85ec-f672d0fd8029
 29 17efd23b-67a9-0776-8428-a4a95dce587c
 30 c4eea5f8-7b9f-8135-aaaf-612127df130a
 31 50b156f5-ff78-21b6-ba20-8ef28466688d
 32 a622602d-1aa9-6480-9cfa-9af81c3c09b1
 33 8a599550-4d97-7069-b787-4ad7135eeb6d
 34 2c8ba8b4-56be-0136-ae5f-40e26e41e645
 35 a4dbc527-3409-663e-bcbf-612653ac3be3
 36 5df8b614-477c-413c-afbc-fc4c52fe2da2

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 613623271015863882373541234508267064. Exactly this sequence comes out of new Random(802).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 62 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs