A858DE45F56D9BC9 archive

201304200209 1cq8ir

explained decrypted filler

seed 151

Metadata

Post ID
1cq8ir
Title
201304200209 → 2013-04-20 02:09 on A858's clock
Posted (UTC)
2013-04-20 06:09:50
Timezone
UTC−4 · title 02:09 against posted 06:09 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304200209) = f75dd7a0cbffd3b48534757ba98b6026 (name+title)
GUIDs
36
Filler GUID seed
new Random(151).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
51 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

ED7F20503BC5DA4D F9E57940392C8E02 F3B1B18E78193118 695D564B9299456E 8C3A5F4E61C691B5 1FE3CAFC17FD3092 7EC9417E49094830 89FFD3FB85C2973A F77BFD7117DA9CCF 40861FA01D36D56B 66EE3BE5BD57DEE8 A130B1EA57B591E6 B3B0857EC97A928E 2B102CC62EF91527 A74BC43EFAB46AE5 312520C4ECD77D51 9C0AB3BE0E6E2B9F EC7FF2151C8B5DB2 F01E66EBFD189AE6 44C48D996C46294E B025456009E60760 F047ACA49B9EC107 1D946CA176ACBED3 A90EB6F3CA7528C0 49D8E70F50F4E212 5DE08ED97074F378 58FBB6E8DED61E18 013850BA53EDA80C B8E0B6E66EC43714 5DB5593C6CA1E7AF D9674DB63F3D0572 F768989F232FE093 EA91DB556FE4F667 296655580870FC21 9B6B5FC95BA3E58E B635381FAEDA19A7 BE6D615A0454B456 10BAC638FBDC844C 4C31B5D72B389D8A DC5E5C7B50DD6717 C0BCF4B7FB222D1D 1C7A01E6AF17957B E1248C6D6260782A 232E0369C084B921 57CB0F04A5A921D0 DBF5123FFD1CDEBF C186FDB23420E506 C70A1CBD8CB41ED7 C6AF10C21BC0B6F5 42C6547C5F69606D FAA76173E45EA8C8 9E5D88E4E3463F27 99EA34FDDF8DC5D9 BCE062E4038703CF E1C66B3824AA2D54 F5CDD269FDC31D2A 61CC078923500726 513AF08199F11D44 EEAC91A69FCDAD6F 4BC63EB1A59A2322 842D5D1DD4509593 ECC2EA7ECCD477D2 87FFB8125EB29171 8B2BCCF2F8AB7104 C3E5990109C989E5 6BC62A79E2AF4099 5543A2D4B39ABE37 C83854470D88B908 A2A38E8673A4B2F4 3F1FB143AF73F0EB 0E5D2CB206F484E2 9CDFF947B215D216 F2AB28BE2381D21D 49D9CD4FE3829D48 2BDAA8B0EB2B01F0 7C99E189FCDAACED F5D6F9B3F6BD795F DC02D9C5351B028B D03E752D8C759BF4 C292F9A39ECE55C8 5BD76274CA605DF6 BB62F4BB0104377A 106FB0BD420D50B3 1BC79B44BDE3ABB8 B9231FAD7955C06B 0A26EB7E138BD0CE 99A3775939DC3918 0EDBA3F25ECFADC3 2CED1756EC301C5E E1E608F9387224D7 D12D3064376B2E3A A60757BB19E066B8 2DC8A3A8269792D4 66CB6D69696A8434 D23EB674D55C0C29 36258D9296B79E6B 53A1D2888A9E5B76 6E565B48EEF68C51 030FCF0FFB16A15D 7BDBAA2A99BD6B1D EC8C13721377B0AB 70A0E2EBF82DBF7F EE1C1F4BE386C762 311B4A0281A7A9CB 4993EA52557C0A67 BDCEA89181295277 60833EEC4913A423 04B5E6748B3C56FC 514C2301A0B9787E 5EA271E75FBB78EE 276A37B93C4A7C46 F753821DBA6D45ED 9E4FE20427398D21 2E1DD00A5F0040DF 83C28C530EA9E5AA 2EA775C374334F6C BE60B06BC64408D9 5D78020ACD672B5E F9022328EFB0B235 A12936DF8F3CEDC3 4D8E90E824F80BD5 92D3E4B7CEA59861 76E66F0720FF5B22 75B52BA5BD9F9A32 7F48DB84B50D37C2 E2079E7077ED3586 7D73FBC2393B30F0 6220B0FB4DF34E11 49598CEEB0C63D32 2C46B1DC5BA46732 3E4D3C3AB0D19D4E FCDC0B29DF17C0FE B14237C621865937 FBB4D41745E4FFA1 68E5D0894FF5129F 4CABF16DA28B7C58 F795E89699FC0E21 9FE2773DDD952444 646B74D377AA0C6B 66396769A6E2E918 05D89EFC9D431363 871008D5B426BC4C 0AF841F8FC0A958A 8747F16D06F7A882 D2F499E363FBEAAB
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304200209 (name+title). Key = MD5(password) = f75dd7a0cbffd3b48534757ba98b6026, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e046995e-3035-54b6-802a-3de97d79aa91
  2 815da957-5be2-1062-8c16-f4cf1bbf0f96
  3 d32d06a9-ca85-27f4-8fa7-3521ca1129b9
  4 fa2ad34c-0754-7dba-9c7a-709a5e6e67bb
  5 06eddb44-8212-3b9f-95dc-1d719bc4473a
  6 0247e33e-bc49-4d9b-944d-01e3d7ccdfcc
  7 957081f7-8203-5fe0-9f8b-e742de81303b
  8 d3866ef6-7036-147b-bba9-d0886f822430
  9 9e045859-ef24-57fe-bf38-417ef356a1ca
 10 49d6be41-570f-8b6b-ac1a-cc666dba374d
 11 4166c5cf-de18-4986-9aa2-9d14d19aa101
 12 f5a5d660-e9ee-33e0-a63e-8b0cfe2c7de3
 13 e4c702fc-9bca-3536-b012-091f617502bb
 14 dfdc070c-4027-0539-8b30-5f8f5f9d8db0
 15 52d0c8e9-bea0-693f-bb79-b2356b0ebfab
 16 dfa59ca2-afd8-2279-96b4-4306b4a60d9c
 17 3e092364-63f4-3381-8112-a777e09af40f
 18 7bff7e2a-576f-5df9-b222-5184e8646180
 19 16b85494-80d0-69a3-a972-6173b05b3405
 20 1766f9d4-d7cb-764f-bc78-b7e018046960
 21 a2f70c75-daf5-78f5-b96c-648ad7e8c31e
 22 494fe29a-7138-862b-95ec-f67380f42df9
 23 1a0b6f1f-9a0d-46b5-9b76-2208509f3003
 24 3b5aff16-65fe-7dc5-b51f-65374ac52f20
 25 9f7005d1-a98d-495b-82ee-f6e20b5418bf
 26 5ea7158a-2751-58e9-85f2-2da276b5d978
 27 2cf6e86e-27c9-60fa-ad2b-9c4faaeec759
 28 b6eaa5f1-6bb1-283c-9872-838560c5bdd8
 29 40981698-8863-2579-a45c-35f148a95ece
 30 f6b8d6cd-186f-6763-9e49-55a6ae6e3e83
 31 e97008de-8691-80bd-a71f-d24e737bb7cb
 32 5988dc33-4b64-2f01-9775-49155bc45982
 33 ab97aa5c-7f9c-00d4-8911-430ecc80ef82
 34 c033f62f-5221-665a-b6cf-7ff7f7cf4f6b
 35 da674529-32b2-33db-b70c-45f6ff656e70
 36 be9b4f2f-a900-21d4-9705-f456f9c95ece

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 512734515843306235677847456226820632. Exactly this sequence comes out of new Random(151).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 51 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs