A858DE45F56D9BC9 archive

201304231535 1cyfh1

explained decrypted filler

seed 964

Metadata

Post ID
1cyfh1
Title
201304231535 → 2013-04-23 15:35 on A858's clock
Posted (UTC)
2013-04-23 19:35:45
Timezone
UTC−4 · title 15:35 against posted 19:35 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304231535) = 52846f2879c440b1841ab0b162ab86ce (name+title)
GUIDs
36
Filler GUID seed
new Random(964).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
73 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

BC02D162FBB55D83 2F5DD2DB03257A41 5514DB6CD3F9C938 E1D3DE78ADB0A8E0 82B7F0ED79680FE8 C4A76011F8335DE7 744C9E1DED14BCC3 E2A5991DAD9B487A 8035369A23327443 D5A375C9855E8760 A2877564A5677484 750DEA06945562E9 DC67DE2B21B7E87B BB303698E1DD4CBC AE0F32CBD745CFB9 D869BA831481C2E9 A6ADA849F44B3995 4C15BF7174993BFF D7A3A8D3FF3C11C7 7177F15200FDB9EC 5BB83970BEA47BC3 31738897566C613F FB8DBF82D6ABCE78 90603A67EFFC6180 EB47BC998D0FD575 CC889F8C28B3844E BF723DB26A820B28 F620D9CBA12E3CBC 7C807F78873501A7 3D534FC97F9844B8 6327CF1AF8B67655 B6190412C1667D40 AE37B7776578FD8F EA33B574FFCC9817 79CCC4D462F74160 B067FC47A79451E4 9E5743FDCA42023D 4CD5399EB22DC360 CD7C56D3ACFEF9AF F20B2FAB856AEB14 FBF5E78B4E0D8EA2 660A653D1294096E A43AD2BB409A870B 3966D26B0CB6509D 5E394C9332E92C89 6847845DB3949188 2F54FECFE5E3767D 5A9ED76F0C609041 8D02AC37554FD2FA AE9D334AE05AB5F5 FF55B6872F66D70B CACE4AE4CDCBC2AA E7E157E73B51293D E7F7C3FE86CE35D5 7EDF3F304FFE6C06 FDEE5AE9E038E8ED 337DF4C7DEF5A726 D855E140890DBC87 5D399C68858EC5DA 56A0BF51081CFE6A 7F6F1980BB7AE55B DD34EBD5B9AD4359 3419D4A14A3914A4 1F21EC0469A9B415 B5A0AFF3EE24261F 82D4030B63091242 109E82FA15D0C0BA 56F596B98684E251 394EBC9FE0A4A134 1A75C124F55B8AB0 FF2DF98A06EEDC34 56B6B8BA640063D8 5C34AF510E883FF8 05790C8F013D2989 E1F3EA9A9632F178 4D61B97703CA5310 F9B3044946D42056 1C9D6B44EB9C582B 79A176D09FE402F8 2D33F441B9FE1497 93C434703416C2ED 8E02DA6E436D0F34 FFEC14F7C8E1E9B6 DE72E962C31D2E66 3BAEC7B07FD64C29 58762801B48800B8 0EE929B5D22E624E 880DA3784383C238 CA483CA5604250A8 A2B23566A82CA296 32AF5A4F48BC4DBB 2D76F043C2D1DDCD D3F6C50C828DF18F A4D931F8F2FEA474 E428175B9361349A 862722B36AABB64B 04A5BA791CC6A9CA EAD35B8D8A41C92B 0C9D8EBC3A964002 59DC2BA969C43655 29ADD412A7D29C9C 841A2D86923E7955 6AA3E88B7F19580C 78E739A32628207A 6A04066EB6A232A0 27EE6360703FE296 D5B64C40D8717D3D 6D2FDCADD0CA9CA2 6E8C3712B904C75F B79E88FB9F4D6CB5 273642C0B4B5B68C 55BE72A2B2F689CB B4B071C88A1AB909 9297F3838FA1C05D 71BD57F738B25CE9 EA337E4540F49AF9 913C66CB658F219F C2ECB1F08C257F7A F51290A6EAEFA738 DD3F4B1B529F0684 73603E75AFE512AC FF3C6F38D3083FC5 9FCB692C516EDCCD 5FCBEE7968E14B69 49D299B60E3FF9B8 EE142A89DB8830AA F7784EA0658B13BE C3E7B501E2E9094D 7A7C8786F64A8B04 8001AC4006A7A752 0E3722398185B021 3A818926893AFF97 3F3E39F4975433D1 19BA72C41CC87DF2 15008A8C1C8E135E 7AC2C80231EDA3C2 0E822C194ED3FEA3 C8687AF7A458D68F 592B9BADC7EB3C95 138691A55C0D2425 384557E8C8D4D7EA B402AA5D33C8F704 64F8CA87FD14F98E BB69E1754E0E3067 77ACA8D506C361F0
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304231535 (name+title). Key = MD5(password) = 52846f2879c440b1841ab0b162ab86ce, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d67dbfea-d150-32a1-bbd1-da0cb21623e1
  2 b1022b59-c7ce-6dc4-b687-794aca71d2ab
  3 c40bf0c9-4fb8-5ab7-a305-62da4406d766
  4 d845f14a-b654-2ec8-b1d0-a4b9a477daff
  5 a903c22b-3b2b-3081-80e6-3c495ded1e3f
  6 4d3d3c7a-edc7-85fa-9567-34968544570d
  7 b1578d31-b979-7a47-a9ec-040b878f74ab
  8 8869cb27-370e-001f-999e-7593ac3639ef
  9 4c583650-2638-2151-b623-cb0623da5db8
 10 8f1eb50b-085a-64e8-b6e2-e2836a99846b
 11 2c1dd0e3-bf3c-46ae-8083-157d3ce295aa
 12 b2b1e628-11ea-0b90-8db6-bb7ee38b331a
 13 68665599-99a6-32c9-9bc4-17f85707ff73
 14 f672560f-27d7-875e-b04a-697c93392ff5
 15 5b10ad9d-ffbb-6490-a56b-fb7ff2db8b44
 16 827129af-fe79-0f65-9504-f243fcfd9a43
 17 30643416-374f-00aa-bccd-3a8f66adcab7
 18 52c41c56-a7a2-64a0-9929-3c62eca9c01b
 19 e5606663-8095-6265-82dd-5af9820fc040
 20 b2c85b42-bf8c-5e05-92be-2b9d4c82837f
 21 6715e2ef-9472-84ad-bf2d-edfc0b172f2e
 22 38993a76-f700-332d-95df-9e7a791513c9
 23 2c151ec8-e4d0-8944-a73c-7bd7c137b735
 24 4a5e72cc-3057-7f44-9f17-1b0255096086
 25 43f677a1-7e66-12f6-84c0-c00264d36a5f
 26 7883f85b-a6cb-4f32-9f8d-c5c4d797250e
 27 6ca849e4-c14c-648a-9cc3-012a26b23414
 28 7f71a97c-9f13-88c1-b899-5e74be25f4f0
 29 dbe55c2a-f558-7d1d-90fa-16c92ea6a81b
 30 304afd22-556f-440b-90c2-a1f5f9efe9d4
 31 c9da67d3-e2d5-0388-9a4b-6423b57d254d
 32 e8a2b715-b3cf-331e-8b43-d362daad9d93
 33 ba4a9690-5c70-8a68-9741-3b3447066795
 34 28728b28-3a57-14b4-ba70-0fca26480e9f
 35 7a459f05-8535-24b9-8536-4c08d27aa36d
 36 b42e1f19-f6bf-4b50-9f9b-8a6c26cdfa80

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 365238702640386006658387146874038124. Exactly this sequence comes out of new Random(964).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 73 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs