A858DE45F56D9BC9 archive

201304300820 1ddk58

explained decrypted filler

seed 638

Metadata

Post ID
1ddk58
Title
201304300820 → 2013-04-30 08:20 on A858's clock
Posted (UTC)
2013-04-30 00:20:37
Timezone
UTC+8 · title 08:20 against posted 00:20 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
32
Filler GUID seed
new Random(638).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
102 · predicted N = 32 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

19F6DC01FF5ABCE8 CEA0C99E3CE0C90D 9509FB044C27EBD6 3BF7352FEC521AB3 0CD1FE87E2D76E52 5D63BE5854155A87 5F9C75BB4C277D7F 93A76B72A26767ED 63CD9892A1343CB2 469CA395FA5D322F 7D8D4382C7C2167F E550F5A44F731B78 1BBA681B68724952 5FC11E0F29C43090 354105755C4BFEC1 52EEE7AF73FCDCD3 C0202A43F30835DE FE8633D5CC453357 5E682ADA197189AC A04DDD0CF88AB27E 5BD4C34C0E4A86F1 CE027DD420746A3F 49229B0073A3CD8A E35359C092B6EA86 7F338D4101AAFE8E 0AA855D47E9A3005 3407DFC8704EA2E9 245A100E85175647 C06FC501AC1D04AC D0565EB242CBEA58 25A4885B14F56459 A7144425B49E4E94 26343DF9594E02E0 A3E22FBDF51D66DB 9F649D7781B2709E 1A0CE87A1E90898C 6B321D57FBF34B8F 4AFBC4A65966861F C9B5DD3CBAD4FD16 166435D83419F2B8 9F4ECE5161740C13 664F2C06662075D1 A6C2D60D6C716229 37B0BACB3713C108 1D0383DB6A6AEA79 166659A261F1C286 58047DB3459F5A15 F2018D87A9DD5DE6 B71AB424310574A1 DC8100866C6D64FA 22655F209313EE92 7E819D29F0415668 06BD994A3B14077B 3E4B14820B6E6FDE C325215486BCE495 FE5CF2EDC96F5100 8792B5654AE92EEA C2D788F3CDAA3154 7E65B59E7B4C028B D46E6E9FAC5DECF0 7E2D67B13059AA8E B9DE4E900E98B4DA 3DFEE495EA64FBCA 5CCAB0658401E0F5 9E115607A52C3E53 68E58960653CC475 9BE6FB5213CFE525 6D65FA4243FBD65C 84E09CB13D8C4426 67C56D20732CAE00 BFD19907CDCCB52E 9748E402E6138E97 FD5E6865CB0FC662 160FBF62A37BD341 1332588DBC63964F 880CC4D9909393E0 8C9FAD8903F0F425 C65CB53E85628DB3 5237F814CB7090F7 B3DFE51584DED1D4 11227676AA5A2BD0 A18B77A6C8DEF94E 9A81B42E5C7D72F0 F837A9290D82DBF7 443FD1DB66BD7400 293F93C5081C87B0 3699FE1D4DE90354 0B8619D46DBECCA4 1CE73B7833661A07 F26B087A7E5D2B7F 596196B0CC006252 FE2F4D2B2B32E857 1AC2E0088D1B7B9F 11BDF1852919CAAB 67DA83E73D7665B2 E1168FA53B432EBA D9B57A2A5CC0C285 B20243CB1F0BFF82 0ECF3A05DE41A3A5 A3BF79FB14E6ABEB CC181DB24FB45994 66D70BB3C95082FA A9CF05502BBFDDB7 8216232E045C3B1C CBFC8002CEFB53D8 4BD6C420F619959C 3ACC43B0C57874CA 1D38470865A2FD3A C9A7E7B69E5E9237 1E2B9C1117DCB247 D5F5753C881C1BAF 45EE009884975650 0E5001BBA2FBD5E6 673A7C374D534C63 147CAF28E263480B D77A9598B8E9EF51 4B47E2EFF025DF18 35621B7925461453 4B0268D02B71650E 7AE5DD1CD912574A C2916A1C7565B1F6 832029F18B722011 6EB20DF8D9CE4DA8 B0F4656E640B9E94 F619CA52F18155DB 0781D9593B6FCE0B 949C123DD541685B C250375A6F827EC2 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bb277cf0-83cd-0650-8d81-b20b168aa232
  2 2d61f992-2fb5-085c-85f0-c7699dc3ae51
  3 f2e5a655-d5a8-66b7-9099-ca43fd4eaa7e
  4 9ebe2b88-2df7-68af-8855-fc4e4bbac8a6
  5 1e80dd29-442f-2994-b674-1efe71e3fd65
  6 1e1f6679-3d05-0d2e-abcc-ef9336f2a47b
  7 8fc93fa0-1d27-657d-b33b-092c8c17cab4
  8 5f74b73b-7c39-4392-a15e-bc3682945d44
  9 a4b82d64-91f3-871b-a7dc-d42f79f13b57
 10 c830d08f-7f85-4ab8-b138-76de08611d3f
 11 771c6cf3-1569-2b94-aaf1-7b1c52122c01
 12 ab7c2807-5f74-5396-aff3-743225ed3527
 13 0b19c87e-4100-2411-a0be-6706f9b34d06
 14 51d7fdb8-1899-3a49-9d57-0eb7eec03996
 15 10dda004-f9e6-51d1-939b-75da2db5372a
 16 1fab0f68-c894-4e6e-983c-c7b35afe6ff8
 17 23c4d0c9-7700-0bc7-8588-2cbe630c25df
 18 be58fdf2-8f80-4f8a-bcce-5081ff59af01
 19 dc12518d-6ed0-8edf-80f7-15c58cb2841b
 20 18cb94c5-12d2-3dc6-bf3e-5f86c8bd0171
 21 a6b60294-98fc-552c-9966-2d0dd5735d71
 22 1745a395-2900-3a71-b614-96a8334f16d6
 23 9868caa7-5e38-70ec-b2f5-1b679e386c7c
 24 23e0c308-c72f-8397-a410-59518e8bd3ff
 25 2c7d574c-8d73-2bfb-b304-389825ce3d79
 26 2f13c0d3-9051-74ab-a998-77474647fbac
 27 d9660578-3a27-45c1-be04-74058e7591f6
 28 a0d5d241-b7ba-8087-bf4b-2b822235f965
 29 78039fb1-169c-6da5-a3f6-4c15650a032d
 30 5e83864b-3bbb-874c-a274-70f5e9b1cf0c
 31 e8865547-a657-67dd-b8f1-8447c0495aac
 32 0830d7b4-5fae-4845-8959-9ea2ec0d2e64

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 00662064842523540483537827486864. Exactly this sequence comes out of new Random(638).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 102 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs