A858DE45F56D9BC9 archive

201304172340 1cl1cy

explained decrypted filler

seed 666

Metadata

Post ID
1cl1cy
Title
201304172340 → 2013-04-17 23:40 on A858's clock
Posted (UTC)
2013-04-18 03:40:52
Timezone
UTC−4 · title 23:40 against posted 03:40 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304172340) = df80306ea8a3947d0ed24d7719ebb77e (name+title)
GUIDs
36
Filler GUID seed
new Random(666).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
38 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3E1E60D1BE58C3AB A60576E387B98512 911587638092657B 92F203DA4DDE712A 6935201C7F988640 58137E98315D7E8B C3AA6399F94BD775 FECB38A1606D7BE4 F51DD0269FA01A2F 0D60BEFA6A562658 A91BB8E0821D1D08 4628B27CE57C68E9 60BD5425DE791730 C2CE3FC0C4880BD7 55C6F37CB0E836CB 8CD9B0CF5C71C485 9AD14BCCE2E943D8 CCDCD9B05F672231 EB83B0DD6117405C 96FB271C474377B3 A1DEBE1B9001DBCB 8FB51FAF96C088F4 849330B528942FC4 04FD80FBBB94D973 A26DCC6249974C62 F95AD03277B3F5C7 00C1BA2E8113681E 6C88C45BAB013E83 BC74B64DBD7D7D40 474A823174C4D001 6812744274A89CFF 05E353DB307179A7 BA3B6AA27E19802C 2A3F85C0857B97B6 A393261106D76D5E 01419BCBCE43ED52 D93C8912E3CD8C4B EB71F31228688C87 F8F13D39B34C00F4 9CF345C49C3081E9 14C3ED27D5EA3A74 C54967955F762AFF DB4BC6DC17F0A9DE D47041F0C0C4F858 6BFA3160C94CB9F9 DB03F894C355BE85 296B4DBA99B5EE59 BFE4DBD462E8A95F DF3DE2A81F0C02CC CEE3C70362F7EF42 CFB8BA40317049EB 59F812F58EA1A23C 7255777EA970A23F 7EF737CFBA354B8D 0F0692AE9DA9CD79 4664862011659527 4330A5A8561FAC67 25166311195A89AD 7928D57500B53A36 71CA6EB94ABF9AF7 1815666BD15C0BA1 0E2891DA3B759F5E A1DFABD7883E6DDF 312B14CFD7EA28D3 95B3F55249E67794 F93F51F5C896E22D AF95B77939059A05 8CD6C02D86187D3D 265F40129513BBE3 B0DA01B05BEA4607 731A96D6E6C92D2B 45F62935BC4D8CB2 6E91B6ECC5955B92 D686FCA8BDEBA19C 6973F653631B8462 B873BB0CE29505D3 6706EB791D063D23 75344EEE0D216A3A 7906D4F407BF3E5A CE5E5A4401D2D786 42EFB22D98ADA3FC E598C78F1CB9D563 F9842D35C264537D 9D60C6EDAF71A5BC 6CD6F8F799EF7C09 14D91898561A8F54 9BFBA517A510C6B3 06E4B960C8E855D5 F15978BDB92E098E 2DD4458EA694F844 7DC8BF1443E25008 4A132784C26460A2 D3E8FCF538CADEE8 7A11B71D73DCCFFC 4DA28DC6DC8762F5 5097AD28F029E8EB DC0DE63039A7FB91 7C021896404368CA 4D7BF29158761EB5 5F75DECB93165BF2 06F69C9D72689115 B5805A81333A2225 E8196947D0F347BD 59FCB561D07E8696 F515C623B70F73FB 1E9920D6BB75C7B7 30FC7413240E4D1B 52D63F66284FF59B 5ABEEE053C0CDC0F 0E12F490FF268072 FB1F54923E582F42 7604BC8E872DDD69 BD53344534CCA5C1 14BE3BBACB73A362 F0BF16DFDBAA700A 4863F616F6011253 ACB25E99EBFED1A3 B41D5CB9573A664F 08648EDF4A64623B F42CE2A36587F076 D700B4BBE4524B26 942266293399756E 7416223B9D03E98C B6765A822548BAE6 A0B7315E5EC9425F ED9B9B553C2E147A 9E7DF8B74D3368C7 969F1C6E795C83B9 9E9E5FA438E7A8E7 2D974F7019485374 040B9934B247C221 2B987CA3F8DA6302 DDBCA4059D3FA412 B12D8020F31D8EC0 22FBEB3ED3A92405 B2590716FD40FBA0 6724BA67D31F652F 8ACD35B1135A3E7C C2A936F966AEC534 13BD857035EA041D F07A15751DB941C3 AC17025DED048A74 67C0EF49F2E01287 E92CCDF674D29375 858020094B88D3D6
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304172340 (name+title). Key = MD5(password) = df80306ea8a3947d0ed24d7719ebb77e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8f7af499-9c6e-578f-b658-bbba6ed644f7
  2 309a3672-a515-256b-9458-b65d85fe73a3
  3 c244e788-7087-2f60-aa07-b88288781a7c
  4 5d60c5b3-e699-653f-af36-e0b012d8db90
  5 ed57535e-2f82-8592-9078-0ed4e5c0f2cc
  6 8c55e448-cd21-556b-a83e-21aa5d61bf9d
  7 269c0c67-3e2f-23d4-909c-902ec7afa242
  8 0227230a-6fa0-599a-b1e3-40b282e5fd13
  9 2c9bac6c-bdec-3e32-9536-86838db81071
 10 961234cc-f6ba-7e51-8628-4d1a4dd53f8d
 11 9863a848-8d81-81ee-8624-c25b5eeb6132
 12 341469be-73a9-3718-b6e2-b8eec1f88780
 13 1b9cd58b-682a-4ff1-9a3a-a1717eba7d57
 14 a1b1921b-4389-8cb4-9c46-2bf58d7ed56e
 15 28910a8d-6822-1f22-9923-d1dbf8f78696
 16 3a44d969-0694-8b74-859b-ee57a1ed86a5
 17 c6ddf34c-2dfe-7a6d-8ef4-f7db88db97bc
 18 6e7a3978-6c9d-803d-9861-9f7eb8dc0021
 19 dcfe6ec4-cc6a-638b-a8b0-b3e83856c742
 20 5b580c08-d578-1872-a4a3-f342bab06fe7
 21 f55e6235-e5b8-2eec-9438-11c42fb67481
 22 f1fef5cb-dd3f-24e3-a789-b52ec3074717
 23 bbb77952-2dfa-4ebf-b536-5ae5658ca311
 24 517877fd-fd63-6c05-8241-d22b7dc62640
 25 5fbbcba6-5021-86b1-b0da-88904e76e970
 26 a94c12b0-7db6-75de-a18a-ea159f92cbef
 27 ad4b928c-9fb9-4ed0-8539-ecb742948042
 28 ca448eb1-5ca6-3977-a40d-1d7c82cccaaa
 29 ffcaea03-3859-445d-b617-46717b5501ec
 30 2866a7ca-bbb9-42f7-8578-c54ce6b545c9
 31 6c460406-bdcc-0a4c-98c8-b97164b94561
 32 96e28053-d558-70a6-b136-aefa9d6cd413
 33 e12ffdbd-f8f6-19f5-8b0d-a69372e04431
 34 df2653a3-78cd-6b06-bc23-02432295c357
 35 f5ccd651-f642-12cc-882b-bf73075bac66
 36 dd009a37-c85d-5e04-8581-e8540dbb0433

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 522685253783481878612246874344071615. Exactly this sequence comes out of new Random(666).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 38 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs