A858DE45F56D9BC9 archive

201304230356 1cx9xh

explained decrypted filler

seed 529

Metadata

Post ID
1cx9xh
Title
201304230356 → 2013-04-23 03:56 on A858's clock
Posted (UTC)
2013-04-23 07:56:46
Timezone
UTC−4 · title 03:56 against posted 07:56 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304230356) = 83bc941680373a4d2df378c08c646cc9 (name+title)
GUIDs
36
Filler GUID seed
new Random(529).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
70 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2EBA19F48DAC981E 257E6C3BC7644230 04926CA6B7D4819D 6FE6E825438E4CE0 482E387B2ECA2C81 B78674D8849D04AD 87B7AAE08B91C97B 786E3B3A69C143AF 9A1B10584536C0A9 ADE6744FE3D1E397 BFCC4E6939180A43 EA25580E936EA8E6 B6E7729C9928E378 2FE3E7A88588320F 5BE2C6FD1CD2DAF3 25931FC3602425BC DF324A6750A319CB 01A3B43117DB4713 1491E0AB3FAE8372 EE45CDEA45992B72 E1C96A79333CB387 8DF6CEB387ACAB53 AA4CC94847D735F4 7BF81EDB1AFBC749 E6AF5188B7B3499A C8623BEB2594FDF2 6B3BFB23237822FD CC8713D1AA21DEDA F035779AED8F0AE0 501123661D79AC69 653DB275F008213C 6730C6211174BA82 7149A1A31183A2B2 FC4B9F3D7E43A58E 0CBFB345D6E545B9 B71102CE7AA51876 25EC48A7F90E3E9F FA1D793A29B0EEE8 1559CF4E79683B0E 032123444273C1D3 8A003EAEDFE8538A 9604F1C53CB05C7C E4ADF68FCA826AEC 0152B7C06336C4F8 642009E6965D8DFA CDA1CA8CB7D8B17D 4A0B474FC3FD24E2 1A5CD3AB2B44A68F 09451E7696E28D9B 20F6D9C4584EAA36 89B728E381D598CE E64F7D40DA6DFBBC 6D4D9FF60D34E952 3061B50C9FD91608 F26CF7EA0A835DD5 CC9CCA4921994DAF F2DC2EE7679ED97C B9AFC5699A788687 472D013E0453DD41 FBCB87A665238F23 F6D9751F6735FBDD 4A450A1702966122 88CE670AABF8A12B FE47ABA63C72AE78 D26F3617333B3943 28ED9D5C93290273 083143301ED8B0E8 BE93285600A96B88 9B16F063BD2C8288 E3DA2B5A6388CFD6 0F6622043C5D18C8 5618517EC752776E FA737777A3F5FF56 2D9F31E4F716FE72 A88D2ACB1A4F8F79 C1DAC7FD1AF99722 50BEAE1055C5AD4F B4A83723A33EA744 ABFD9B275BDCB08A 95EF85AA52F6EDD7 604784207E8DCB4E 7A3F3D5736A3D80F 51F63B2BC7BC4BF5 F037EDA590718694 59AEDA66D7DADABF E084D2F3A7136DFF 41090C9A36B091FA 480B1C591B8FD0C6 4BC15D617CC8C9EE 8750045CCF88A595 E06DF408CC802066 191279D53AC470C0 E8EF6838431FA0D3 4A084436C97ED3E1 E99C77F0D06C5CF7 500C7AC03BFD108C B4F0C86F4C8C989E 9DD58905F17A6A4C A0B191567433EBF0 1394C8E4BE482170 D1F300D975A8941A E5920D6BBA618BAA 15CBB14B268F0F51 1492DFEF34D74B82 43EDF2A537D78C4C 4D8FF60ED73AA3F8 8528EDC006C3D414 9EE5F152C6B100DD 119E1CC650505887 EBDAD85F7E106F73 C2A94FBFF3D7A1F9 A927E5E0F6EFACDC C83A98FAD946A060 337851775118FF04 4A07ABC1D267DD1C 2D4A0F53EA9F02EA 898E0C18EC45B474 E3C113E526428C22 71DE97C36743746D 7634266FF75D5BBC 0C7095F00EED9C25 D0A67F6AF9A3861A C6D47B238B424B68 9F5754C990781212 95F03FFA96D391D8 BBACE9B06C9588EC 6654159F189B27E3 87F88ECF33B2C2CA 6E5BB6306DB435D2 A5E785DE423D44F7 CA6E8A3B30372C65 5C563CBA657E14F1 E76714F392BAD5FF A8149E561D3087C1 494E61B913E01CE4 17182D76AFD67BC8 E58A686BC381D652 FA4E7382AEC0D9CC 0D9CFF074BD2DF24 C4F0622051250341 4DF6FE6FDF5B13B8 4A392056D800F8AD FA8B5526EE8B8148 580707B534933D50 1C90B7B9C76BF57D
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304230356 (name+title). Key = MD5(password) = 83bc941680373a4d2df378c08c646cc9, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cf8f420b-4439-000e-8888-11e0be368e55
  2 6e7d896e-9155-0935-8bca-ba58f68086c0
  3 f472de02-f8e6-4c03-9a9e-e66639d3bea7
  4 b3b14b60-957f-4337-93fa-52c977e947b6
  5 b3e601a2-c403-0f75-bc93-e2af5e1373c3
  6 05c68d56-8379-7277-ab48-17b278b6a91b
  7 a0b34c97-54b6-8dec-aa00-282fa6ab5b3c
  8 fe652f6d-9564-7325-ae1d-f586126530c7
  9 11997397-266c-3bfe-b7ab-bb55e759658d
 10 ed2da6ff-8531-3ee8-90e9-c04a69a69f91
 11 5337c7e6-dcd4-0250-a150-773d6a472eb8
 12 80c946a1-f73c-43e4-a2d1-53b3f9e4e26f
 13 86d3166f-a417-2ec3-b553-37e145b7978a
 14 90085de9-d6dc-6c77-848f-8da5bb951c84
 15 168c71fa-8b40-2b15-934f-86a2ee3ef3bd
 16 cfadfd60-a063-3118-8067-98126e1e749e
 17 b76d60c8-9208-2498-9bef-a4e17af18a37
 18 60d04c34-21e2-8d8c-ba40-0fb0dfbe09e5
 19 ffcee035-7548-8383-9659-be54dc5dbf29
 20 d2a9a09a-0403-1970-accb-3a13e06373c0
 21 67d997d3-6aee-01fa-9593-05953585b2ec
 22 1ebb6592-a209-54a2-b4c2-aedeaad0770b
 23 c98a743d-e72d-333b-9bf5-723180281e44
 24 35d07fdd-5006-742b-9df7-eeb1d49f6036
 25 4ac533c7-3a11-42ee-a8a7-42e019e89ffc
 26 5a2bf975-fb4e-69b1-bef8-ac6e2299fa09
 27 c319e53d-1c83-60b2-948c-f2063bc4247c
 28 a365b376-d608-4d92-9574-a13f0b73e99f
 29 e4d403bc-bb49-5809-8f62-18f8612b65de
 30 e8ef0f78-8408-1035-b587-d0bcb71201cc
 31 31b9b527-835b-449f-b04b-efb5cb94b2af
 32 95b201f2-b7e1-7236-a1b3-8ab85ef07a5f
 33 7dc10c97-6a2f-08e4-8c03-d4eba9b072b9
 34 235b2396-1c36-285e-bf4c-14d1f35c2e40
 35 e4ebf5da-0b4a-3c79-88d9-39db73e4c62f
 36 a03afc46-e427-6b7e-874b-7b7c41d749a1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 004407873304262328810537466451470236. Exactly this sequence comes out of new Random(529).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 70 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs