A858DE45F56D9BC9 archive

201304280741 1d8o1w

explained decrypted filler

seed 791

Metadata

Post ID
1d8o1w
Title
201304280741 → 2013-04-28 07:41 on A858's clock
Posted (UTC)
2013-04-27 22:41:57
Timezone
UTC+9 · title 07:41 against posted 22:41 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304280741) = b84cd2b8d3bcf4166389cf45e8c4ac3a (name+title)
GUIDs
36
Filler GUID seed
new Random(791).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
90 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
19 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

BD979C4D868071AD 9BD0442B842449A2 6D985EDA4519719A E49B07E47A3CE93A 3A988B9338FB2D49 E104AEA63DD53230 9A6C9FC5EE5F1E4E A040C0A9B0C5799F E349E8719B07B665 2C17F03A38270C0C E1609FA11974BC8E EDC6A6646128D184 D83958D275069DE6 DD2C7E5D53EE9544 1D21B9558010C6E7 D2413A69B85C1B36 E5F19E45D4FAD3FC 4793CC32195825BE 18BE99680B80AC94 23ACAA83617AC636 A838D0FE8A627061 B6C8B735860F91AC 2AE8F71C47207CD8 F6670D40D073F835 272E60D3B652C32C 40EBDB5BE483D298 18262B9CE5A134F3 4D50A21CBD0B428F 03D77C4536443992 5668C10B8265DD60 7EB0F41253E408A0 ECE33A366E950FC3 B1F0FB65FD196C6F 93FD3503F1C71DD9 E0F5181860AC40D7 9E54BF7BE0B32906 CFE2B3715FF4DCA9 89DB7671E1D62DE0 CB781D67FDA91D1C E7AB5A8FBD82BE4B 0D0DF0F1530B4087 4339B7F9838C006C 51677F491343444C 76577AB0F1D1A142 F3E18C6A7822C96D E2BE18CA20412DED 6E4726163E96A477 29877CAC0B11D86F 3ECED3D724978746 0FAB7DD18D376F09 106444F7A1BDE58A 571A819A4B9B0ED4 DF1F4845F1E2DAB8 20F69DDE6E332E01 47E366A982EC12A0 ADFC8F031A118D58 8729BD0FC0330E4C C071EA2FA412CBED 5E9C76855F72C2C1 CC9BE4EE44D13D31 99AE1AF0882C3468 0671018A3607F92D C25E15AA645C6BD2 2C53B6F0ECCCBF23 7ABC8230D3913A60 EB83A49319AB0540 F8B156DBB343B4B9 18AD0E51A439B3F1 75675E30F8E03524 9F6FD571F203EE39 D77B5F3C24C9D7FF 3186847C3B1198B3 CACF5E819857CBF7 F01E54C37C082F64 BF3C8911EFEE3399 B10B151A58DD36A7 91D276E75F5E8E56 233B7CCD365478D6 477F1B731639ED02 DBCEF4F3B97CB808 FF8D24A4EDB60CF0 F5BD3038058A3BAF 9C2CE44F39070F14 1C2B76C91EBF5FBE 3C4CEFF7A51E7520 164771C9F13EC85C 961C3C5E58C0A0D6 21BCD7C1ACCDBBBF 91DF27BB145E09BB 625855E7339B4830 33AAC88101A0385A C3417918257017BB B53841FA7E869468 9E6FF1134639EE9D B82A6D22A41F5B0C 3DCCDD11B156ADD0 24C35E149E44FD58 60EDEA52150D2633 76300CC15EF91DC0 15A56DF379155BE7 1D2CE43D380A4B13 A7361A83E3E90134 FE73F8CE458632A6 0AC15DE255C5C146 86B1133CAD3AA2C4 052A5A95C24751F3 0BBB69E35BAC4D88 6BC1848C45E5EBD8 FABC542C81735922 7D291F5EAB96EF67 4871E20841C43D19 F7F9F39A732A09F2 99EF34DD89F247BA 58CBB8E958B827D0 30E607B941EBC773 175191C29610FCF5 37884BF0DFFB07B0 8CCC94D84C0CF85A 2CC85CFEDFC65FC2 DE428B0D0C57D8B4 665F6ABD3394A555 DDC6F4C860538134 AD24309801CED1FD F8D7E9D24A15EBA5 CBE7DDEDB8634F52 84C1051A333E332D 85A6CCA1F59E4DB2 439AB87796E0B551 B2816C69939552F4 77ABB536ECA9C5BB 3771D920EF260947 B6F5059A111C6BEB 970537240239D5C2 D93F886258768A85 51054E53B5B13ACF 9C2CB5DFEE46C5C2 8214225A43B576CA 1748B89F0A2F9B01 1944F31788203FC1 2E56ED6A73F8DFA0 D227065ABB66DB70 FD982CCF24DF2FF1 D71772548D9DED8C 00B43C92427DCFDF 9515ACA09A2F9541
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304280741 (name+title). Key = MD5(password) = b84cd2b8d3bcf4166389cf45e8c4ac3a, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9bafca41-f63e-8461-9753-df96b76a7416
  2 32832409-7732-851a-a331-06bfbf213c75
  3 0248d0f9-050d-604a-87c0-1849f9db194e
  4 0e79af97-f692-363c-8105-409ade05f6ba
  5 c2d16988-392b-2e28-ab62-98faa518fbfe
  6 88af7baa-1287-7a6f-be00-afa4e335dd41
  7 7619b13e-75f7-2c6b-bf61-02ebdd8c7be0
  8 027de2d1-f03b-2622-b273-6d9233703e86
  9 2efa99fc-04d8-7124-87d5-a55d999f6d4d
 10 f191f96f-b81a-88a3-a0d0-68d6e314d07c
 11 d2099974-eb2d-0090-80bd-1851730157a1
 12 d8b133af-27cb-022e-a7d3-4da971fa79b7
 13 0649d37f-811d-3530-ae1b-cb3e85186464
 14 2ca85cbd-42fd-8783-97d4-ddf630c8461d
 15 a28e23a1-cac1-5829-a30a-4604845129eb
 16 08012f89-8902-0146-838c-897ad3a4a5d7
 17 ee176855-9cc1-3ed6-8cbf-6de2294411f2
 18 bb45d6d6-65d5-329f-8ade-715363724942
 19 484375da-d183-0fcf-9a22-e9aa23ec42fc
 20 3e631d5d-910d-5e68-8f73-d4e7a5555332
 21 df3cdf9e-d802-87bc-b375-171c50d91757
 22 98446b61-b8fa-8fda-b46b-f66bd7e371e1
 23 4b5bc67b-ff4a-625a-ab80-ef28bca358fc
 24 b94c1674-d388-3ad6-949e-7f3f05f092e7
 25 0733443c-a36d-2472-ad8a-9f7fd7f60981
 26 b01352ab-4477-2f49-8bd1-9fc092bb0bf1
 27 21332227-6adf-050d-80ea-0d908583b925
 28 3ae1930d-d0e7-7473-842c-f50e0e0396b0
 29 94f1c414-aa0d-0bf2-b362-f87bda03a61c
 30 753a5eea-6fb0-11e7-9a8b-0e44a1a0e3d5
 31 ba3dc892-1019-1f5e-ae86-609a8995e1c2
 32 8b033f2b-63cc-74fa-9d58-0febec32c3dc
 33 cb3e6972-446c-3e13-a1f7-595f497d36d0
 34 fa43c1cb-f858-73c1-9f9d-e5c123aa849e
 35 d26ad11c-c506-7749-b9a6-0e3f4764d2a6
 36 c0a147f1-2268-05ea-a93a-ac671279bfda

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 886327227800385033058863220701173770. Exactly this sequence comes out of new Random(791).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 90 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs