A858DE45F56D9BC9 archive

201304181512 1cmhhg

explained decrypted filler

seed 852

Metadata

Post ID
1cmhhg
Title
201304181512 → 2013-04-18 15:12 on A858's clock
Posted (UTC)
2013-04-18 19:12:51
Timezone
UTC−4 · title 15:12 against posted 19:12 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304181512) = 4cf9b4769600619688ffb3a0ef2c3730 (name+title)
GUIDs
36
Filler GUID seed
new Random(852).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
42 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5039FB21F84B026A DD1BE38BE4B6C9C0 8F44D96865AF086A 87B1D42A82D4E69E 43DC7445B319BB4B EAAEEBCBB0B4F1A7 F2A34DA9A2E2C5E7 A838767B5EC63DFE 73AA9AE51163A810 4E29379762D6D8A7 B1449B181E548100 0369007E2BE77BA8 136E6236A1822B6F 6259EFA6C1632792 88869F527B7EB653 A804C6B80327CEA9 68F7A491DCFFA455 F8CFE61B037A0672 88BD193CB3635486 D557C472007EDBB1 4373BEF440A499DE 995AC35D72B0AC29 6560E81FC3921AFD 13CB2152C739F99C 3EC24FD327AF6B7D 4DE720E3A6B28A0F 0B00CCC71B42CA7B A34049D512181320 2D8BA78908BFCDC8 18AE748F8AA31D37 B869AA112B2C95A2 D8B939E560862D9C 8B46498892AD4932 3C9FB1173736450B FD545E55DEA5813B BF4A75FBD5AD1C56 1F1E4B54DD7A3061 88B883395596658E A4E98A5A30F02C32 B348180AFDEFEF08 F82DA4314AAE4557 54A11AB48895DDDE 28020785755E82AC 74D8F4EA58CDB654 15D149AC85CFE0FF F118FEF85D5F8328 8CCDD639EC79FC12 95BCBC53ACFC6223 338495DC5994EFA1 680CFE9BB5C53904 2FDF92C17B25C462 614B6A98FABB3312 9A0C7DC202CCDFE9 3427BFBB7E70025A B356F90D15F4D248 2EDDF9B85B978F5A 066DC4C4CF07355B FE52B01A5F7187F3 C919AC034F7C0885 CE5A176FD329D475 870FD4AE9586446B AE10BEDA7E5D1DA3 3B4047A94DED238A 1BEF5DD869DB3725 5046D65D6F6B9D21 5DD8F81BD189EA78 84C7EF1EC46C4369 33BF6A9ED29E56F8 50FFECC6BC0BE05D 977D3D1D11EA6406 20B686CF1ABF3108 D601DA77D815AAAA 77E33DD43283475E AE394100536EB741 AAD071856B02DAB6 05CEB5020A1B6C0E 12B5FA78DBD543B4 4E2B24D4784825F2 5A6E33D2AD219CBF 84C5E06B08519C27 8AC971C14D67100F A9A3A57C9F606C62 0F677BA6A4C0F033 6C8E3EA95777D896 9E47A4287C2874DA 8AFD337957C70FFD 61F449D707588B9F E1726D52D6139D35 507F0FC8E6914829 DE22A9D5709C0FCE A2DDB729112A0D97 D439B801BCD7B33D E9C292DF2C2247C7 467E34CBCACA36B3 230F5B1217C3E4DE 627CC62A5E24988B FB23FB55323CF3E0 4D7C38DB162E7BF1 47D57F0326F2EA67 7AA7D512BB4076BC A3C43ACED6E0BA33 8327FDD3BA414429 B6FB35CE17FB5028 19AD0E8DFB57A2D0 80DCB817800A4794 2F4C724C8386D906 A5D5F013D7998C66 0F5C0FAF578179C2 AFB658826381D997 9599289A2A938F91 833BD591DC06FCF6 D7CED0B755849C82 EB3C969AA6641856 2EBCC9C4A03174AB A83D92378593775D E5D567C23E55D37C 4DFD07314A1013B1 48434CA980F2EEF7 2CFFF6A727CC409E FFF59FCC2432A0C1 3730E454C2E35777 C78829E862496963 56F0E8222C383892 925AD7E754C42EEC 913DC654F53AE292 63121E42E82E59DA DF8271D831D57A0A B06E48E7154841D6 487C8BE8E6A4F601 579EE27C1CAE6CCA 273977F838ADEDC5 EF53E34B74395EA0 AE52D3037F456350 6668DF35061C94DD 4AB8195592088D29 744472C4B3FF4A4D 51539751242CBFFB 18749A3C5914BE1A E980CB95A0562927 FD4B36B018B9A10E 2F581DEA53DE7B61 C3767D0AE0EB9330 57ADAECAEF900F06 1AB07748EDF48AD7 7504BE33639731C4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304181512 (name+title). Key = MD5(password) = 4cf9b4769600619688ffb3a0ef2c3730, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1b259b70-8c26-70fa-8d13-e54c7785c861
  2 db0d63f0-5046-78a9-8d98-fc35f434e884
  3 333f245f-99d2-2510-a12c-aacb16a98cb6
  4 f5409d2b-08ec-3715-b7d9-4b94d34729e2
  5 7dbbd08c-3734-7c61-9a35-56773d9d5aca
  6 34772742-a75a-1db3-b0bf-ba731a5d2c4d
  7 b63714d9-a222-5a7f-be37-522d8b569b64
  8 822e25b4-1f6e-7bdb-8aba-6a092f3df666
  9 61261f0b-589e-3e23-acbc-a87b93a52047
 10 0be01473-ffd9-4dc3-8159-e5ea50334953
 11 4ef72764-7319-8024-8ec9-65f5651d91d0
 12 f505cef9-d4c9-506a-a726-be79f69311ca
 13 97bb4693-c1bc-3daa-8081-76861dcce07d
 14 58aca54b-b41d-62ab-abe3-ac42c10e0baa
 15 29ea6ac4-6ce3-395f-8372-8ea055f6b3a3
 16 56e37dce-f965-1d09-9a4b-1c4c7422238e
 17 de2cb770-dfa3-0395-8cb3-d857fa06ddfd
 18 915941b7-6055-2c73-9007-ced3e664b38c
 19 5d468ba6-798b-61e8-9cb6-45292c585394
 20 4441c379-a433-1a3f-ac45-aa75574a9e6b
 21 22f3316e-1cd1-0ed7-93bc-5250e3d400ce
 22 095dd621-f652-7e6e-a07e-73cc01237831
 23 fb3fa43b-8f04-86da-a79f-ee574384631b
 24 8e88769d-7fff-6a78-a606-b623983fa130
 25 faa6b528-e339-1979-9f06-a69fe6e38603
 26 106d46f8-0666-4375-ae7c-f35200827c12
 27 a418b507-7db7-41e3-b486-f2411fc6de8e
 28 dff99591-da7c-5fc3-a600-f97d528a1ea8
 29 1a2bfe67-a4af-7b9b-b5bf-e12939f61e18
 30 3ce53af3-f188-290c-a411-5b68c10a6260
 31 50947019-00c4-6967-971d-18054c8f0c56
 32 7b8dbc40-283d-758f-aaf8-1b66947c7e3c
 33 6c39203b-bbdd-8b4a-a2ce-fee152a51c5b
 34 6020078a-42c6-3085-9b7a-5e86ad93ab2c
 35 9c030601-d933-1a0d-9dbf-5f5f8e90a8de
 36 3dbf6b12-128f-64ed-9f48-2a515278481e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 772371573485363102610786144572678316. Exactly this sequence comes out of new Random(852).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 42 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs