A858DE45F56D9BC9 archive

201304150146 1cdhb8

explained decrypted filler

seed 552

Metadata

Post ID
1cdhb8
Title
201304150146 → 2013-04-15 01:46 on A858's clock
Posted (UTC)
2013-04-15 05:46:55
Timezone
UTC−4 · title 01:46 against posted 05:46 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304150146) = e4dfdc56068a9e3f0042c5886fc93c2f (name+title)
GUIDs
36
Filler GUID seed
new Random(552).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
20 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

88FFC676B9B85775 4303F0F5E32F5CBC 2572CD590C7CE778 468183C6A83E497E 95BECB3EE808FAF9 E3067A0338D3BE34 B8C286DBE8A66EF7 726538391A696F91 D678573299880951 BB6124F15983E33A 80E6361EDDE0F64D 70C9692D6D43218B F73E0922E17C327C C376E475B19AC376 26B5D4FE4161D782 7E62BCCAD0E413ED B4B239A53DEA4DC6 A0CECF237B71694E FAEB99FAD5E78590 6465DFEF23A7BA90 DE1A1F757C4D358D 562759B0B1960BB6 E0B2BA6CB0C47EC0 808727FF4116D43F 20C78CC66C5A0AB8 357D2EF9686A49BD 91CE203DE1E71C07 2C9AB84B3D024031 0808AB60A224F111 A40CC3E5DFB7D4B5 7ED04DD730817EFD 91F8EA40BA2498A1 9B4F41D107DBAB54 1C24D3FC09743A2D A199F3582AF13E60 67D28204FF12C193 1769B47E07D75B84 0CD184B2D789275D 56E07CA80D7E8D8E 14E41D3771763CC5 CFA28E39C028B047 9ADB0FCB614CD021 9FB4667CB075B923 6537F7D5563929B3 ECD7E41E6CDF4EA8 4FF8E949EFC697F9 968E59E7E1C51EE4 217684FAF1314176 305509D94C120E62 BA3DF2C986C1E37C B6D6CE187D183411 DCD5A8D2BAC772E4 958CB044A6410735 319BAAEFCCFB0EC6 E6F9B36A2E3ABAA0 D30B9D220E3E4621 6C7FBE361B2C996A 79BA680B84205BC1 53A01D6CACAAD91F 6D259BC486E5A77D F796AB570A906F0E 723D11BE5A73AD5D 2123C285AD23883F DF98788A801A8640 35D787F5E90EE7D6 4EB93BC53119477F 1E536507C8AD3397 3C11554AED1A79FB DDA4025DA0ABAEAA 732F8FB199538413 0B1B7E4DF3FFFBA8 3BDD6EA195CB6149 F33817FD9B8DD438 D426B3D5F9055EDE C648394C5932E092 464833BC14DAF665 27BD938A6EAF4BC9 87A58B43393110C3 9CC3DC9ABA0C82BF 6D10A26917D08ABC 5B72276E4D81971B E26556D89018C663 7B79A4F46630FCCE 33FE32C43650C6CD 69C8F31598490A87 ECC9ADD489CB7E91 A1D590A88256D9D3 F38B67CCE1126C25 99FB870DDB2AAF99 06F490882A1F9F15 54B5D9B686442C45 B5C3217CB071B9AE C136E534D23ED34C 1FC9895FFE72AFAB 305349D888506773 EC3363D354301DEF 997C8ECBA5830F98 8AC16F1228905EF8 25165B104552078B E080619F683E37EE FC285F84DAEA6DB7 C0AD5F246D2977D4 E02449C466C9E7B6 F4351011143B5952 F409C3447EE5E76D B03460B2CEB71B00 E89E0D761BA00778 7568A1197D204545 10DFB3ED7DC4D741 3D1ED1F4882763FF 67F06D0D9633FC6E E6FDF39373443781 862FC8C2920EA645 4853E546E2786E80 C4CFF2D75AB06789 7F7AA9F25E47EC0D 64BDA2EA40728B52 D5C1DF7C5A222736 AC9944612ECED41B 81A5C2BEBAEC5B50 2C9CED4D28E1B3EA 75EE09E5E92D7A2F 5497C63E8311696C 9A3D6BB976E3A6AD 55724421331066F3 62D99AB03CF96C3E 6E89ED821F805C4B 9F8189630B8E08D2 370F30C9A622D6BA 576794AD1CBBC78A 7B9F4628549BAE01 29D4DC207EF2CF09 32B935F40884A9DB D9773D36BDC51A98 E1B5F31DD42B489E 9AAF1ECAD447A090 3FD16F64992E1C34 4B573E471A2C8786 AD60FCE02D03DD8A 66875FFA3D64D5C8 F16E03DAEAA8B1A0 BE8424C04D26F23D A773C4943F1C303D 11EB3B02822A2B5D A8B660F020A5109E
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304150146 (name+title). Key = MD5(password) = e4dfdc56068a9e3f0042c5886fc93c2f, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c784bac5-b75c-049d-b417-b3a192dc9370
  2 aabba743-2f4b-74b7-9949-e3b8bd02ea61
  3 65d23910-3bab-57f0-b7f0-71a5107b04ae
  4 0cb1f994-e2c8-3b28-861c-d65bc5b6cc2e
  5 83b0c988-9e01-33f4-80e8-69bf07add149
  6 8c871cef-b76b-8294-a920-5345ebdef9a7
  7 759184e7-54ba-266d-9e7b-8c5eae762c6f
  8 bfc918bf-e982-3e72-8c7e-0ce48155f5b7
  9 e523628d-23b1-2fa2-b6f7-22647ef50f0e
 10 9d3d7cfd-169d-7c64-abee-e9c309b59aad
 11 b883e114-f2b7-8ed2-9ab5-82dd8b5033db
 12 d06b0573-5932-38d4-abfa-7db1ebaa64c2
 13 70fc1d10-92b6-046e-8d20-44ef00fda6ef
 14 f5d7d9b0-6305-5276-82be-40180bf3c74e
 15 92f51715-cae6-3336-b6cb-ddafab50dd83
 16 79ba5323-dc03-6b34-93bc-bfee040358e7
 17 0c336fdf-a8ea-808d-a9f0-6ae5e92f408c
 18 d2e47dfb-3370-26ca-a227-40b24235e0ca
 19 db404038-c740-5fe1-9dd0-5b261b0d26ed
 20 502726f1-5a7a-05cf-a242-159759c9da0c
 21 1cd4b088-2fba-1e96-a6b8-8cfeb4585228
 22 a717abd1-fa14-25c6-977b-81e6b3259a52
 23 814b3040-c916-26ea-a7fd-e16fefdbb380
 24 812fa198-c2fc-7f97-bff2-863a090e9128
 25 8e0a075c-2318-7138-988f-72505c120fed
 26 13c728eb-3ecf-5577-a836-821ffc8e607c
 27 0b35feff-aca9-433a-b940-2378c452dc7f
 28 5c589be9-697b-61c1-bb53-29e36421a043
 29 a926049b-a938-01c1-b2ed-7309e609e2fa
 30 bb315d80-e108-5a31-b20b-299de63afdbc
 31 3f413b50-88c3-8f46-b6ca-10b2137efbcc
 32 7eb4da5a-442f-72d7-b4cf-8e013c10224c
 33 ad8aad7f-d78d-2501-9464-3aa134f70500
 34 fe4d8be4-bddf-77fb-9057-120a7a6019d3
 35 20f38988-6cf4-3d92-9b4d-eefc2d4add0c
 36 5a6454a5-f399-673e-b203-a9bd85a4841b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 075338232783053682501227754605872736. Exactly this sequence comes out of new Random(552).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 20 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs