A858DE45F56D9BC9 archive

201304260735 1d44qs

explained decrypted filler

seed 983

Metadata

Post ID
1d44qs
Title
201304260735 → 2013-04-26 07:35 on A858's clock
Posted (UTC)
2013-04-25 22:36:00
Timezone
UTC+9 · title 07:35 against posted 22:36 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304260735) = 8254e503820284e1dcd89b84b562abe9 (name+title)
GUIDs
36
Filler GUID seed
new Random(983).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
84 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E9E6D6DD4FD23489 9E5427E9931B7B38 25B4B7C646EC7EA0 F2281E4BA221C6AE C634FCFE55CA5EA2 92731EDF3DFA2341 86AE28DD48085450 2382D089407CCEF5 6080D8C2C7A93401 8BE40EE0FB98A35F 8BA0F264F9524808 A2653497774ED6DB B0110BEF24E3A86F 4D8FDD7CF4EF5085 8DFD29B875B75902 2AAC81F922F3002D DA2D0F154A9163AB 6BB42916F501988C B01BEAC0E9756C69 2FA067E14C1C3CF8 2CEE791AF5534156 05033A38EA409855 A830A4CE41CC9B2A 121FC001099130D1 D86D5FEFD5F0E613 F51CB14FD908FF18 E3F894C88DEAA4BA 0F61ABE9037E9679 6875A2F8B6613BB7 43BA4ACC88415E3C 015E98E11A6AB7CB 37B4091BB5E05EBF 67AF2F25F44B7C65 72FE7DBE959A1092 BB2066A91E0207E4 588DDB59765CC2C0 AD79662579759C9F 0B616504B4B4A8F2 B0AFE4B2B7C3E289 F117418F803FEDBF 12A4DCF82B1A206E 5B01E21EA0CA6D53 CE6754A7FF6CF614 10A9C0F798D1030C 754EBC1C04470DED 67F7E6FB19EF1A6E 963FA063F9585D7C 5FCFFE1694AFDE89 DAB52BFDDEF8E1A2 5A29041FD6BBC6D2 18F322B6C9DA8D89 33C925CB1D56F3F2 097669F567BD38D2 0C43F9783AD8EDB3 1008A01CB31BDF0F EC0461C99756DF9A E37F28F929C93738 34BE48A5D264B7C0 E8B51F2AA3F1CBE6 E8FC8A25DB47CF45 9E7A4977BEE91279 7EF7FC420BBE6554 B5A11310A07B69A1 0AE67111BDC76673 2E4EDA2ED1724E4F E2AF36B2641D9ECD 731A7C1734120ED1 38E48A0FE7EFA9AD 9B9FE5EBF5D5AA40 2E4C90D65EE2CFA2 ED889F1D00833B25 4A307343EEB9AF58 BB1A386ADF0DA412 D9D5FE4A31297AE1 49A35606275D1953 CC5E18AD11D451BD 680C2DD5DE46CAD2 16BF9997E8C8D70B 41BB49CBD49FB9C3 EE0398F5678CB42F 898DCE70902A6742 040B55E93423B366 8FB3723A5BAB5C9D E3D5F6FA5355AF0F 860031A1B02C1975 A19781922D1FC4D3 05A50386A03CCA5C 7283A5690AFE96A7 B2C4EED1CA88EF44 B612B976CE1DF235 26D5AC85F682A861 D1781807A524EF5F BD05E8496D127BC3 0C7D0AE027DF154A 682E994417DB04F2 138E26A8CB9410EE 4332A3160130F75F 25BB9279C0D59F4D F0F41A25C6738ECE F8C7CA9653A2CE74 8847380B6992E403 6B98FC2260391BC6 2887A53A8D867589 4B5B93F856C6DF61 FF7E3CC86B19E069 832248D8FD57E1A0 E68128D1AC651014 32CE83BEF6DEB2C9 47879B3A5D7F72BB D5FDEB150A5908C8 9221C88280629E79 A09EBF866A8C9266 BFD06F3C13BDA95A 4D6E85092318742F FBCFFFB64A76A037 E0DFE7D945BE331A EB9D5AE5DD69CB9E CDE1F9271D8A91BC EB73832081B35B8A 2EECF53A91D7D30E E2C526F1EBABC051 C6791F94394246CC 9E1DA1632E39851F 4DEDFC5444FBCA90 A2392578AC29B1AF 35B9AC5B2579D4F6 31B61F00AE52AD5D 65E962CF183C2ED7 B697A01334AE81E3 87C6FBDBDF2D90A3 6463825BF278D24C C942DD02E6F373E1 D6A1C816074797C4 9479C9C7E5BDB52E E6471E5FAC765203 8D2F7183D01216B8 0BDC193C5596ECAD BF09FB883B17170F F12FA41A595DDDA8 41FDB72BC8743143 AAB48785945641E7 00FC87D19F1C965E 99A75A2123EF265C 4851E40BB5126B95 9751471048FE5822
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304260735 (name+title). Key = MD5(password) = 8254e503820284e1dcd89b84b562abe9, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 16b06bde-e5d8-2998-87b5-5d1d7d7bdc6e
  2 2391b4aa-0b3c-2e82-9eda-af0edee17295
  3 a15cd30d-c4b7-70a6-9c40-c6b63cea6cba
  4 6f2247f9-33ee-3066-8d80-16f4d7b06f84
  5 7555894f-a922-0359-a28d-214188e70ce6
  6 50a93c8d-3bcc-5926-9f94-010a41996305
  7 06ddaeef-2c9e-3e86-b972-3d6511130da3
  8 bf1fd188-b0c3-5aa0-a2a3-680618d80814
  9 3b1bc898-5276-5d5f-8108-0a8aade0d456
 10 0b193171-bb88-607e-88fe-9acd9d91ea05
 11 cba64d4a-c965-44de-8e9a-b7428dcd517f
 12 830097a0-bcfb-87f5-87f2-5bed6d93b3bd
 13 8426ff74-04b7-340c-b0fe-2cec17f9754a
 14 2986d1e1-fc52-7c1e-ad7a-5529db6ffb14
 15 66e4defb-fc8b-0dad-9d54-c13ce8bff921
 16 40dddf95-dbb2-8e31-ab23-712cc7e9d53b
 17 f4df381e-bf79-093b-9987-98d0adbc662f
 18 9238a8f3-3253-45d6-9ad8-6032b970c3f9
 19 c31f3686-457c-2f68-89de-d5d202ec5e47
 20 e7629186-4547-8694-aef5-73c4e196782b
 21 b7b11557-3074-3c8d-bbf8-a5777ef9a6fd
 22 771a4c15-dcc1-0697-a494-49b800b7baab
 23 d3dbd0fc-ea6d-1c76-98b4-fa6368d5f90b
 24 5c8c7916-a421-3886-bb99-b228e8e984cb
 25 d3d60f98-0634-08a2-97ce-a000fca37317
 26 0a605d35-9f19-6676-b23b-c8bbc9f4096b
 27 d23ad596-0c21-0248-a789-ee05cd601892
 28 d8b8e705-c905-6a1d-bbdc-9cb524d32578
 29 43394cd0-bcc9-08be-8a62-f1f10429ad76
 30 60de20d9-6824-6b80-a62b-019cc5dc274c
 31 5618650e-fc98-01d7-803a-c23b007b0d8d
 32 5c7dfe73-0eb9-3413-afec-1d7c87f3a9a4
 33 d1a61b81-b531-5b92-bfaa-5a3cfc525e5b
 34 703e6bbe-6bcb-5935-9917-dff79c6212ed
 35 9624fe92-8e74-7ea3-8d7b-add3fcc554c0
 36 6c46205d-3447-3220-86bd-f5d59aca436c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 227305355648370804283013060606035573. Exactly this sequence comes out of new Random(983).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 84 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs