A858DE45F56D9BC9 archive

201304051153 1bpeki

explained decrypted filler

seed 490

Metadata

Post ID
1bpeki
Title
201304051153 → 2013-04-05 11:53 on A858's clock
Posted (UTC)
2013-04-05 01:53:58
Timezone
UTC+10 · title 11:53 against posted 01:53 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304051153) = 1b8879dff26eb411284b4247d3c59104 (name+title)
GUIDs
32
Filler GUID seed
new Random(490).Next(9) ✓ verified
Run
Run 44 (seed 1,087,967,875) (seed)
Draw
70 · predicted N = 32 ✓
Machine boot
2013-03-21 09:35–10:19 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CB78E103838BF746 864CAC36CA27C2BD 4B2549BE83AA3C41 872C64AE7EBB778D 7CFCC3B32604FADA C57F431DD22EE834 32E6D8DB58C791C0 AEFC283B1D57F1F1 B4C04B33C91A09EC ECF3CB32BB70BDB5 0FBD79E516BFFAE6 F14A5ADB0A1A7F8B 8553E1064A29FC4B 88FC56106EAAB46E D4D93A1A484C92D4 4A0BAAC9519D3A7E 2CF33689E7632263 B682AFF2267C7FCA 0779B929499AC2ED E062A4D7DD5895E0 A32DC015CB8384EC D2CD36304052611F 655DCDB2AB61A717 232D471A99B5E7EF 52B332ECB74F024D D8B6C963E5D11A3F 4701F8D9C7DBA265 F75ECC57F671F7B3 1A8396BA2B7C0C3D 3B9B6C89C84A187F 16C87D0655C4468B D89663030E37E9C7 4837D399CAA4637C 8C1E79CC1B45BEB9 2E3FF3DBBD7CC588 34DA1B79559EE663 B683618F96A704CE 51A7C45718825FA8 C44F07DD1AECD75B E6F4002AD20A9624 9FF075F3CC8F7F70 ABFC8C0528412D5A C4A438A7728899CF 3906B444391F8191 1913322F34E40AEF BA3E9154BE9AC631 248A538809995FBE 52756888BD5708FF 10A56F8F594DEC7F 9557030228089DAA 9F11B302F2980B2F 15B965605EA6BC5F 9E1B082068C0A3D0 774600CBAA87C9EC 04FFAB3050427070 B1D91AEFDDA1F42E BD08A62EB8A25EA0 C49F1BC236F76E70 0D0CCB5FE3D9C34A 92F09EFC4C9ACF2C 3EBC1071ABB311A3 C5FE7AC79A778C1B D8DC3967F71C7413 1B9DFA2DC99C9432 F2FF68938B4AF296 7364D0EB50986DCD BB2149EF5A6717FB 26BFDADDCD302E5F 50A93DA7EAE54FDF 817578745C800044 13AA8F2DE599E342 CC52FCA461DE3921 C8FCFAAF9948FD2E BEFA4B2E50096E7D F34E3E34DF3B053B C929EFBAB9C81461 5CC9701FF49C46F8 52215BBA8B4C94C2 5B3FD2B1C36D8C47 B6E7926203106FF5 CAD7D6C24A30CA81 C8709A9A234A7DB5 FAA4A92838FD830C 29433D2D570C60C7 09CE686BFDC5F14F 06E5017FA07ABB8B 20B73BFF2BCD9851 1A5EB47816B9749F B264FA282502FB78 121BEF7E3F0BFBA7 9948BA399696AA4E DB5CEF9F30585911 7B775377F105FFF9 CF8F5F37DDAC9542 6B79F6C93599D231 F412387D5E980492 4BCB60FB486D5A0C 253D6AF44DEACACA 40E687208B404CEA A64E42D86D65F3FB 7CC0DA49597759CD FC00BE924C164B1B 6A1965310CDBD639 DA2F20B59BCF78B7 76CD36968FD12375 2A7527AD97E27AF6 EAE63137EEFABED6 4AC296B28B75B80F 4953C551B308E9C9 662E1F1515D5B97A 0AC2824528DA5F10 F23563DFEF02322A 8C05C79ACBE33027 22439DDC910FFA55 181F712651680567 36686B8A6F0E64CB 443871E977F0B214 479CD016797D3267 A455CA814B57CFDE 4682FADFDF5F2F36 83972739849D8834 F83644B7AA258EE2 43E20E4F10056984 20C9319458C61947 76DA9381B1C1AE0B 9B53CD3CFA64B9CF 7E81A33257660990 B3C8D6D5773BA1C5 E60688E24DB9B3C3
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304051153 (name+title). Key = MD5(password) = 1b8879dff26eb411284b4247d3c59104, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7ae9dce3-dd37-6d3c-9d60-3460d28f3148
  2 ba21a041-e883-55a0-b1b6-42a561eb7077
  3 d230bb7e-5739-2982-b7db-d5ed5dc502f6
  4 0d78d2b8-be00-1f64-a82a-f263ab0a04f5
  5 b846f969-b31e-3650-980a-cf3a0f573438
  6 82eee3bb-0c4c-64b1-8793-f8ff17262ff8
  7 05be750b-35b4-4ff6-8861-f34b5cd419d6
  8 1f9baa80-d343-269e-b084-7e57272365b9
  9 e93a1689-9f19-5cd2-a8e2-3d2a2ad67e59
 10 4385391f-9483-853b-b44d-8d2d36177dbc
 11 bebb417c-a82a-2468-85dc-a2f5841b3f4b
 12 d2939827-b9b5-0f6a-9f9f-a0475997dce8
 13 a25eeb28-82f7-4fd4-9f2f-18d4fac077d1
 14 d99f55e1-5cfc-34b7-aec2-b2527c02843c
 15 bce4c13e-6a87-810b-abe2-2a47dd3b7678
 16 aaa25151-3c63-00ee-9dbe-3bb8dd6ac87f
 17 d211254d-bbe5-7b76-86e8-3e45bbe3875c
 18 ca7374df-8a3b-7ac3-92e8-ee42f69f0d5d
 19 7133bfca-ecde-8e67-a9bc-41b169aaa83f
 20 1c5634df-b5da-0ccd-a2ea-5dd3f9295fe9
 21 10d3a416-a750-85ae-b75d-0ce1d8d1d11b
 22 0fab1107-f504-0009-a740-5a3df5d26e4a
 23 910c5452-ad06-73f8-928b-f289d0b54f56
 24 3e1300c9-789e-1386-adf4-418effaad473
 25 53126017-6d4e-6049-89bb-4a2e1f4e561d
 26 69e0d58a-3b67-6edd-a628-ede22848074c
 27 5849cb94-65b1-16f3-b301-43e3025e3b59
 28 72de7066-94c6-2448-8896-3847caabf3c3
 29 0ac4a1cf-eb38-8df9-8dff-3fe809e6198c
 30 20db9fc1-52a6-6043-b6be-a597e13b3436
 31 13e3af01-8a4e-0894-a591-72b08cce3c1c
 32 ddf6129d-67f6-49d3-8b44-493ef20c3c25

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 65213642582043807780807166128604. Exactly this sequence comes out of new Random(490).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 70 of Run 44 (seed 1,087,967,875): new Random(1087967875), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-03-21 09:35–10:19).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs