A858DE45F56D9BC9 archive

201304230749 1cxhl3

explained decrypted filler

seed 337

Metadata

Post ID
1cxhl3
Title
201304230749 → 2013-04-23 07:49 on A858's clock
Posted (UTC)
2013-04-23 11:49:45
Timezone
UTC−4 · title 07:49 against posted 11:49 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304230749) = 3aa100f40e20fbfee6b53284d16ec5b2 (name+title)
GUIDs
36
Filler GUID seed
new Random(337).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
71 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 4
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6A61A0374D1582EB 9718771EB850DFCA 311A6F517638BE0D B412FBFF0DA33822 33326C26ECC16C86 9FF55B8059BE4A7D 05FDD1048B1CB468 85FED264A05013F4 462C2FF731A4ADFD BD2DA80CC47D8A79 E2B5DFA85B74F1DA 6EEF1C424229FD82 F7981A60DC2B79FD 5076BDEF8CAB83F1 136060323D353568 3BCDEE4DB4A38CEA 230453E6CEDD9A5D 52C2BA099CF2B701 13FC00635C090080 F72BE1C7E5338C77 0CBA6D6C258207AB F48FE1329BAB9A3A 825D659C52624D0D 3D74AEA0DAF5EB2D 2B9E2161C3E3F4B5 4424D770A22E09CD 231573B6041BAA70 66EC373B5B54E0C7 49CAA0B16B0B8784 F450E3F110818E35 9C9979C64D3CF616 9717BEBD33D36704 616308A4991213ED EE3F1DF0A22841DD 6D8B71277F264B79 9D623D2C4C06418F F9754631E850D672 858C699ED47E73FC 8646F196B75669BC 1D7949D7779CBA1C 482C765C65D1329F 0A34FB92DBB125E4 E80DB1E2FDBFF1D2 77A41D7AA113CBAA 28F9174AF1E746BF 0C652D715468E4B2 A6C5B55D06AF7DB9 A785F0926388C346 289B899E1FAF2F8A 41BF6D4D82539D3C E33D1B145150F75C EE31A1128C4F2314 9B0F3681BAB2AE7E 138A7DB0BC680B43 8848E54FF9B74BC3 CC7B4719782A4823 218253AC155BBD30 F57556F63276DC44 36CE39AC282C178F 53F0901BB78AAB1D 4E337D3404994D5D 69909875E64C9269 765B89316B7B0D22 02711983EC9C7227 19F2B68275AB3362 F793F3B2F02E87A6 652AE7D1AE04E668 F1B9983D4D94B014 C66A8B27EA3E7396 1A453A45E66F3021 25FF76273413625D 26EE725DA8D79099 1B136966E536738E 236D7740C2E4C8A7 FBAECBE4F98D76FB D0A8FB3FC2953CAD B52A3E9E49706DC1 4992C16EAE6FA52C 3C327FF12EB52B51 AFAA5140C9697E59 80491FBDFBD0DDC3 BBFCE00B23DF5B49 82A3AC589B76A395 9545069A871AE2BA B8CC5366FB0780B2 A31D2F9B3C124A1B 01D05338518A97B8 C0E2C1CEC07EFED7 94D27E8087E18FB0 FF796885E9C46F54 9D690F9FB943C673 D8FF3FF59BB9C406 A8A9E5C059ACFF60 FC6F453554BB8894 6CC14622C666CC79 4C99ED73EDFCAF38 1C2FEE3F39CE7251 350C9551AE5EB562 E73F18D6D8DED1BA B1B19AA0439A1E44 1DACFE36E4B797A2 8A162FCB48161135 8A19CE791CAD6A60 BBB0318777074876 857C9D43CB8E329C C98F04D8FE93AF4D 5FB0D3EA6DC164E2 558AB5B2D526AC4D 22E4F64A65F9AF4B FCA02A69A5DE4591 9D735D9B510D93AD 15660FD95E6F439D B2B98ECD7836AE06 4995AB2D1EC9D713 36C2085F4A7CA5DF E9DDC1DD07F97A4F 047867464745328A 11D8D15D18487984 869D5188C5D27A01 07B6D2834E92F4A1 0EB06145C93A9A8F B584AE8AF2E5E846 40D6A88EDE9B0433 42506E21F8C6ED0C 900EA2C3554D25A7 B10BEA886477CEFB 866D61B050344365 E8CF7D64587AEC72 58CA6861CB79123E 69F1A645DC8B9063 836193F52F496549 7B1EA2F3C5AB8A56 1E643DAB3140F56E 14F05CA0E7D3BF64 54F7AF10F8466EAC FFB6AEE2CFA7D8E5 071068839DE4FBBC 2005E0C2F2E843E3 92F8B2B3A555E3E6 79D03FC720ACC90A 5ABB131EBFED3034 D6F698E2E887D369 C226CE92A6BCBDD5 9471DBD8E8C7B0AC 72C1484C0713B072
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304230749 (name+title). Key = MD5(password) = 3aa100f40e20fbfee6b53284d16ec5b2, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 deac6106-79e6-717f-84b8-3e5ad92e5219
  2 142bab2b-b85d-679f-9fb3-3e762a20edb5
  3 e130c619-b97e-217f-a2b6-16f9123cd49a
  4 e3141f8e-343b-473a-af05-74a1dae03024
  5 30873f9a-1a40-3acf-9815-dcff0ed41d5d
  6 1f0f09a6-9195-0922-a648-f5b2b830248d
  7 6dbe5123-274a-84b4-9933-d8030d4f6f05
  8 83ca2de4-6713-47f6-8b1d-1b6ce3dfd292
  9 2de41697-7f9a-671a-8d14-99dbec70462f
 10 a73f5de9-eca0-4f31-8791-1a37c52d89cd
 11 fdd394b2-6e89-529a-98ae-db01c9a9c5b6
 12 008d8173-524e-5792-908b-c4d6f1a8dbb9
 13 762ebc1e-1f7e-2afd-aaa1-c88deb3c405f
 14 53b8c079-fadd-7804-bdae-c3e59de1297a
 15 7463daa2-7c10-75aa-aa39-8bf3f979bcd7
 16 9e9f5d3c-d7b9-42e3-89ed-766f074b915f
 17 4031f75f-391f-4182-8cc4-87e34c12b964
 18 dc76dd66-69e2-85ac-9dd6-ad29de73a5cb
 19 4b2bc5be-874b-748a-8264-ec79021696db
 20 938b1742-9843-7092-8eb9-c93155edea4c
 21 ca79ea5c-6c47-5e99-b716-f827456e3f57
 22 e25e3321-488c-4a79-893c-61e7b1dd145e
 23 df9bc839-64ff-86f2-bd94-f592d483b802
 24 7affac94-c1c3-6484-8a2a-92dff4b50bba
 25 d91483e1-a943-6e56-af87-a0dbfb0dcd5f
 26 b9a5bf1a-0481-25d0-8227-151b9f710db3
 27 1b86b751-0199-6e18-bce3-0cbe28618085
 28 d6c7a023-2914-4d94-b76a-dba7e4201be1
 29 8e9af69b-43e2-51b3-87a2-2591b250dfdd
 30 b98b379f-4c15-4452-bd18-e59ce6fc46c7
 31 4089e4e8-84bc-558d-9487-3c0a0841e7a0
 32 955028d2-87b6-1394-ab59-8bb5c3dffa98
 33 c6d646bc-226a-727a-971e-afa1fe0435db
 34 148e24c7-5329-3b44-94cb-f05bcd82790e
 35 dfd504d3-82cf-2afd-a17c-8126f33d44ff
 36 3fa65413-32a8-36c3-8a0f-cd2a699190c4

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 762430846455277448775486626454517323. Exactly this sequence comes out of new Random(337).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 71 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs