A858DE45F56D9BC9 archive

201304282343 1d9ujg

explained decrypted filler

seed 951

Metadata

Post ID
1d9ujg
Title
201304282343 → 2013-04-28 23:43 on A858's clock
Posted (UTC)
2013-04-28 14:43:56
Timezone
UTC+9 · title 23:43 against posted 14:43 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201304282343) = 9c42898ed2baf2a18b3ba0e5fa7e2235 (name+title)
GUIDs
36
Filler GUID seed
new Random(951).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
92 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C8152F24BBF92EF1 A734C103F7E51361 A3B88C2948840158 AD8142A7F4EAB2D0 BC0E305BE3931359 8C0BB3C3A0CCF7A6 A8B159499377CD0F 843D2BF2669E1D5F 2E9A1A5AAA8279C7 ED0F65A63174E71F 4D14381BD39C36F5 68409CFDD64C5ED9 7B65FDFAF4CBA9E5 F279B188BE15E51A 57AB659C5625E416 C48E1726B92FFFD4 E5B359BFA1876572 E704C7AFDE4C5DB2 F596DD701EFE5799 A2B639FE7345BD7D BC6B74EC5D0A5369 4B6024D2BC79610A 39E282DB3FE67680 6A96DA4BA8EFB303 13AA70B59C8F001A E04B7215F8042121 D238D4F691B65D59 41BB8983203B3236 93FAB2DCB9BE3B69 D340DDE7BF555D04 60B4DCD746DACDA8 1E84FE89E813B39B AC64B9D1BA4CF818 8683A62303B9404A E3D59E15E0DF44A7 7958C4DB3727955D B0D04A3C8729946A 1BD756E9DF68388F CB56515C2D94ADF4 52DE0C6DFA7374E0 E7F046F2D70461ED 2D4C0424C2E98B1F 374D64FBBC20F463 F71A79DC3847A967 6B3E657472EB8FD5 CC0A26063F9704F9 CF798FC6AB4F0B24 843C94272C2A01F2 CEFB6F472C54F07F A76FECD9FBE5CD89 6D5681DAF037E69F 363A88E7B26DF16F 7052B57E56E937FA 8BB58626C831CA96 60A92BAD860B93A0 2C6851A0E9C8BD4A E59E2A536E6180BF 10FBA9027CCC1C03 2CA5215469495ED7 726F9A66CBCCFF2F 4613C444068AC230 E1BAE90D3D7239C9 CC65554D837493D4 1B8CFBB62F210F7C 005407A8D6A411EA 8D7AA63DBE9C7B98 D08C018E17FB0325 F7E0DA4720DD2AEE 0A822292D7F5F485 EF7403D5EEA60E95 DBC9505A161BFB05 CB9CF7729CE294B5 8A6E4E809EC64F13 59B421DB88409E5A F2C84B3280FA5C60 FF515EC63F4DE96F D1F7D11523F6B8BD 200F99007BD9F424 B4FCC4D560DC54C1 FADB35FD038E9AE3 24699B723F88AB34 3133B8F581701F3F FEC1EAB1CEB2E26A F4766B9DDA839C59 72D27B01FB7D7CFD B07179E7A9D9A27E 7FAB4855D1E572A8 617CF82B6135620B 124AF739614D8379 D66C52408C1F34A6 A90ED6C6A702B265 CA31BCA4251643CF ACBF2D687B3B1D0B 59B4C83E0323D221 5DDB8195B29722CE 2B8D2190EA19E56B 1B9C74C9B10C0224 AE385796F5457D5E FDC27AD5C79F38DD D55C87821C1ED4FD B01017D3E55304C1 92FECEA3FC83EEBE 407B1C82110D859D 6462EDD9B0AADDF2 B1FDEC4D120DC7A3 CA65B4E4DF4325E5 51586D5DA874027F 5262663D60B263C4 017A014F07D48C9E F659AF3C0DCB0FDD 6B35D1684E1320E5 5A293F7046DA82AA 7FFC9BE1FAC55B4A 3599A9ED30FB1313 B0B11D31D8F54970 0C9000DC9FB46CFA 6506C5AFD906887B CD8E907A046752B4 660FB3BC79C3F87E CB77F54A2816D610 12B11A97BE7560F5 384CBEED1029C363 0168F6D1E49C6155 061A4F61D17624C6 F6D43C7659B73624 29E7309FCB74A90F CE0FB5A38B198CED 8AD919EEFBFB4838 EFC30CE81A22AC71 CC170FB2D0A2CF47 B8BD186CC0B257C6 FF9EDE028C4385C5 56C70CEC9AB6B329 547E2E0C734C2A8A CAC827B7A705863C 7F78A918F0C1D6D8 4C2238CEFF1AA251 97FFFEBE9BFC5B92 BBAEFF0334F581F8 1B3591EF39A2D283 B59C046B19502065 09AAFCB1BA4C04F1 6ECFDC61B779F3C0 95E60807933C1C19 BB835D8BA0F0E445
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201304282343 (name+title). Key = MD5(password) = 9c42898ed2baf2a18b3ba0e5fa7e2235, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1c32f18f-dedd-4446-bf38-69dc74288fcc
  2 082d7b7a-197a-7de3-8636-ceab9569667d
  3 0bfc7255-6ad2-4457-907a-bd52313ced3e
  4 5820d46c-8cd2-4ed8-ba00-7b712ddc5f8c
  5 f903db01-76dc-5966-97d9-464ee3e26c23
  6 3cb857f5-f846-5197-bb4b-27c099e7db07
  7 7240cd2d-868f-07f0-be54-d102308809f2
  8 aadc5bc2-0af0-49a2-9018-f2eedb2d61c7
  9 dafdcd49-8979-59a3-976f-2530d783ff02
 10 8435ebcf-27e3-8043-b659-b1d00abf621a
 11 5cb231ff-57b9-86fb-97a9-65da2c6ed3e9
 12 4b00fe7f-9edb-8002-9f4d-559353cabc93
 13 99bc3be8-e13f-311c-a257-d3860a1e83ff
 14 ac29ffc5-46b6-2994-88fc-f8edb46bd5eb
 15 cb2eb2b8-1caf-5998-ab87-c0ee868fd06b
 16 b0226020-5853-86b8-a3da-003315c2da35
 17 d6b3970f-86ca-5f4c-b2fd-5b1dbe9d97a5
 18 a528d79d-3cf2-5868-9131-3bb924f882ce
 19 625a8c11-baec-34c6-936c-c3ae9683b39d
 20 2283ec9f-5375-4bec-90f7-24c0b5627031
 21 56dde562-fbc9-18d9-9d39-5bb649aba331
 22 7a5c280a-f98d-1f0d-a7f3-1a7a2c1821db
 23 049e7c12-ed0d-68f4-82ed-700f48d1eddb
 24 a99e4fbf-f6ca-2051-b2c5-5828da70d9ae
 25 b04d07c2-fdb3-8727-b121-d1ad03d1d73e
 26 4579c426-0b5e-14ca-b4e1-169a053c88df
 27 bbc6ee6b-150d-5d84-84a4-eac2259eb4a3
 28 4c161dd5-6a17-84a5-a6ca-e83af756ee8f
 29 847afda1-edb0-216f-91e2-6bf8c7b6728e
 30 3c9f9f29-9259-8d15-912b-df8ba8119331
 31 726db63c-3d9f-218c-909a-f196bcb1c9a7
 32 32ecf559-7d21-8705-ba5c-85431b51a1f2
 33 2d1c1b23-f08c-66af-8b71-319330e391e2
 34 ab7ecb14-f0c9-77fb-bef8-c21ede2839ca
 35 80a1a9e6-ab1e-634c-ba00-48ee9974aa9f
 36 66015e02-5eec-8976-9e52-4792929c2de6

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 474455045888325855341162815828286768. Exactly this sequence comes out of new Random(951).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 92 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs