A858DE45F56D9BC9 archive

201304190644 1co62t

explained decrypted filler

seed 23

Metadata

Post ID
1co62t
Title
201304190644 → 2013-04-19 06:44 on A858's clock
Posted (UTC)
2013-04-19 10:44:51
Timezone
UTC−4 · title 06:44 against posted 10:44 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304190644) = 148193c00898441109e9cd7ed85a0634 (name+title)
GUIDs
36
Filler GUID seed
new Random(23).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
46 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

377F64AB7CBFD9DF E50807EECA5C74E0 3B49F604B44E28A6 0A9EB85CD4EC57DB 51DC6D9A9083E20E 8A883998E7EF77B3 A5A66EE547FDCE35 07CA226308F5377F F1F76A5F1BFC4F21 70749E19B89A27D0 AE5B6E66EF57BB6D CB19D17C82FB06EC C07F5EBC58C1252B CB4A855517982EC9 90E46D102B5A5FE2 F0582196F42C4E35 95FE6784A2824593 51CCB56EA0409EC2 721EEF989A01C495 55A62E08CF15823B C68FE5E14ED006D5 891C751D6737A8C1 91644275351B1034 5798F4A6253950D9 CA5AB771C9494332 81CC6824A841E9C6 292D037749B966AC C52EFFDB164A8B09 F3D35D036FCA4169 6411A81F902E9398 DA1254A1B726167D 41ABA8C4676403A7 BCF6D64CCDE0299A F63E54087AFBF94C 3BBB2241DE6BE322 415729AFB9E959DB BDE78DAD7CE99CF9 7E99FAF8180779A0 9EFC8A99F9DF83A8 A2C5F10DD86C83AF 7351FA83226B05BC 0ECE6EE553012B1E 59F8AE7F093771CF 0D71480A5B9AA65D C88445948BAF0B1C 335C9F1AB4CA5513 7B8C3CE70B819CEA 6322AF0E0F087873 13DB54326301E087 E0094BF760CAAD27 01C8544A684178A6 3CC5003DC0DDC4B3 E7C3563FEBDF12D7 311606220FEB818D 9E83D88D4A01F942 5A35ACE486E94A32 C4CE2441DFA179AD 6591DB2518C3FB14 CB081B5D1D25BA50 0744E123D261FA91 D4ECA73A1BF9FC57 4BFFD8C0EA344C80 5D075E805D10F546 3302B1AF18ED0E59 F6B4CA019F33F905 2E14ABA65E048A0B D38AE7B058ECD461 DBAEB7BD76422755 7E121A36BAF3E277 B840DC6BC673D555 914ACD4615CC6D4A 7C24A25E8D4978EA 09159602E7C1AC0E 79C7330149B0582B 934B0715CC123814 5464E02EEFC42C2E D3EBCF49E51A52B2 E3E7AEB1BF760144 3D7BB2FF7F62B5F5 E49E0B3C6AFABB4B 8EBFA41693D2E58B 79F96BD6624F67EF 90442E189F7F8B0C 165DF6D2CF6B9005 15A8BD8AC28B02F5 ACF99BCE2982F521 376FE8D2092FE25C 04AB0FE682FB0C95 AF354E4C74A063E6 0213CB6AE2C914A5 0A217E23A2ABAC9E A74B97734E579156 5CB47B03B09CE305 19EA75761594507A A6B66F43FFEB65A4 765B0908C0A9A1AA 03F8B89550C1AFF1 9BA1BD5A057C1AD3 C63788C2B9540F5A 6D30AE9F3247F829 6A9A5833E15A81E9 B7016E70CEAC08E3 F0EEB3966EFFF28D 8E3A30B451D9B80F 39378FD5452843D4 D5895D26C1C0E528 DB8F7E5557A4417C B5E73A6C7DDC432D A5022CF938F6B27C DB4B6BC455A9ED8A CBAEF04CDB68FE68 64A1415AFAF73E60 7343DAA89C1E68DF C5F0C9CD61E5FC2C 93557C08D43D76F1 08B78A8567F52632 1546BD81BEE834C2 90AFE15E7B83B05C 7844C99AB762C787 488CCA850841DB88 3BF4C1635D47F5D7 EC9E7FB8D04F4699 EC6DCDA42BD8EC3E 939DC6235192264A 7DDA3C3169B792B8 F03547E4762B4A73 8945D0EFB22052DA AA876F6957D742E7 47DFAC07EC53996E CC963E76975CC1A0 73ECF36CC635E04E A6ED0C1B47E8AC68 95F40F948414481D D8F0E0811E44C5F1 9F54998B74B01C92 00C56242EE41715E AF4306F85CD08087 285E6719032210C4 14E8383158BB0DE3 704B714A3EB927F5 9CCCB6BDA48DA0FF 0580F45E69A56BED E79238C36F7CBEA5 DC85EFD64E5AE7ED 814A0214F27A9EF0
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304190644 (name+title). Key = MD5(password) = 148193c00898441109e9cd7ed85a0634, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5322f686-f4e5-69d5-a3d5-a374f24a736a
  2 71dcb11e-338c-5aef-8b75-96f043a5513d
  3 c77fef2c-1935-7deb-a561-56007be33555
  4 0c8b003b-b79a-4d6f-b398-ab59584169e1
  5 81d7d45c-9edc-5c9a-9738-6c4630aac4dd
  6 c20da309-6a3b-53ab-8193-6aa167c77110
  7 ccc04669-9994-1075-9d8d-27e3c599c8f2
  8 b748942d-9932-8197-ac81-1a442e5227b9
  9 ae6b72bf-8475-7511-ae03-b05b198016ab
 10 bae8ebbb-6cda-6af8-9b07-740189ac071c
 11 30082d42-d6ca-25d6-928a-76f3776d7811
 12 46d4bef7-5ab7-3c3a-a763-a04f26b47aac
 13 1712ea3f-63f0-37b1-8592-cf01d3fe525c
 14 72c7e37c-4e10-3a00-bfa2-1c6863a8bb17
 15 4b46c6b8-763a-0271-a662-b11f84bb39ec
 16 9d1b7f64-3cc2-350c-9f43-b09554c32114
 17 8218b352-27ec-46e9-9611-afbe564ec6a0
 18 df865fd0-5939-2c0a-802c-409912e647cf
 19 eef6a7e3-d7b7-2a64-90e2-fce4e394f1a5
 20 98967283-ce7b-178e-96eb-82d91404c4e5
 21 97fe9267-b8e2-709b-a9dc-ea937b415d47
 22 c118e6b6-eb2c-4219-a1b9-ef963dd61675
 23 0bcf9fcd-b1df-7343-a490-052e57055d87
 24 5f157b58-1beb-00c1-a702-e95a010069d3
 25 7f2d2c75-8488-882f-a38a-7f5942504e22
 26 a6354862-1c4f-241a-9da1-743c0d2c4451
 27 8b1cdfbd-ca41-65cb-97df-eb4c40d1a241
 28 3d04688a-2171-880c-98a6-91f8dad12ad9
 29 a7d4e8d3-7e46-8a53-9fba-66accb5a8f38
 30 3e842b73-83b6-5a2f-ae8a-972f86caa1ff
 31 4452bca8-6c5f-60c0-9268-07339ac5568d
 32 20011fa1-9e85-4d48-a4fb-8390c4ca676e
 33 70e28254-b4bd-4c18-8a00-bac07e590518
 34 73b66bea-0865-510e-9c45-c168e8add2ea
 35 15a619bb-ca2e-6ae1-820e-342d04903905
 36 3a59421b-dfb7-6687-9663-c0e89852f35c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 657455187623330342217470826885644566. Exactly this sequence comes out of new Random(23).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 46 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs