A858DE45F56D9BC9 archive

201304302035 1denhd

explained decrypted filler

seed 126

Metadata

Post ID
1denhd
Title
201304302035 → 2013-04-30 20:35 on A858's clock
Posted (UTC)
2013-04-30 12:35:36
Timezone
UTC+8 · title 20:35 against posted 12:35 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
32
Filler GUID seed
new Random(126).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
109 · predicted N = 32 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

2ABC5BFADB0A01C3 A33A031ECD88A932 359BFE5C67DC3C8E 73029800F453A708 DB9B7622561649AA 151AE93F1BD009E7 483262EC3F2A0BF6 96A528F68EF0123B 2E02F16462607E8C C24EBFC21DAB05E9 47ECB009640FFD92 626860F232B5A702 E20E3C1F995763BA 13CCF236D5413A03 E9E87C3F2D20C157 C427E0AC88D83DD2 7960F2B614097FD2 CBD9A57C435D5C23 DE330328CF86B183 B5301843789311FA DA08C6D9329DF0B9 F00218E8413ACCAA 94026593CC691411 F9E8608302520092 89880619DEC40B30 D0AE073BA03324A6 C4DD7DDFCBF1845E 822EA1BBA598A4CA 48CF5C0C7C34FE6C 28C9743983FE9ACB DF8A14FE4F4C884C A563CD6D898E0114 424CAB955C60F23D 4CFF4DE624DE9A95 3A016F74BA3A3C6D 1841703DB4A62AA4 807B0CBF4D06B259 D84D2DF446B50B07 FE41017ECBF86DB2 EE9D401999E6B136 EC7022E7960771CA FDCD52DFCF1E4EBB CF497CE5110D9E73 81E75A1B2C5C8829 96956D4FF3CE3448 F9AF65C74368BD63 D384FB73946E2DDF DCEB88280ECA1125 5EE700C5E0E3B1DC 042293CB1D1E0FDE 42876214D0A31F14 2A08E1B346948B6C 8860EAE7034B7397 C2427CBE7AAA9F76 818B03E427E7DF93 9E6CB48EA0751984 5F4EDFA12BF5D9F9 A2376ECDA6836BE2 44A6A6857DFC49FB CA5EABC82754417F 8AB30DF904120FE4 CFF1FB27B1752A5C 61195EBCB45BA0DF 3863BF9E2BE001E9 42A0C04C9A5630CD 2929806BD5A7A77F 28E737FF049370E9 23BE2F95DAD1AC2C F3BC6593CE3268E3 1884530C8565B0CA 6FEC590419162C7C CD7642924B438DA9 4524CCFFF0A37012 97458B55B9CE67BF 3E6CDFB51F8EF84F E7CF32D1E7B3E5D2 3F86CF9E35CF82DA CA235CD21AEDD933 E993CAD59F10C0EC CF59D2F3D8F32EE2 91C1A5E3A3D6AE31 FB9C0445940E4E1C 4813E6D2CBD7C365 9BC14192D45DF423 A4BCFC7A65B5762F 1916C5F0D719AEFB 4265DA64368B9B8D 480CA3A5A6845C7F 61A55F903CB4F675 50A12D9249295161 6A3C5660243BB715 C4A2195E70226D73 D728D527F46D28EF 53A8296080CF274F FE7AC45A4A58D58C 7CB44DE3B54AE922 8E4E8D309F86901E 7E9761D02BAF0C98 255EB65D90F9FB8B 029D178DBE5A1D6B 1E6085E6D73096BF AA3511458BFCE633 1E78222422F459BA 171A1EDE7942DDB9 0E6209AC19B78DDB FB7E95AB5492A102 44BDBB8B522E7351 FFE17A27843BD101 170359FD377B7804 770F03269CDF1FCB A8E0D7934BB49E35 E7327404D143A08B 8BE0D1D2EFE5BC1E A854DDBBAEBF7184 DA9885E62C499992 2A5EE7261EBCE81F DFB1935D75EA007C 1566AB9D2D7D294B F670C0220B27C9AB B21A75A537684C9E A5244DE686235866 A4384F6EA4907F87 AECA1E3D7EEAFE43 BAEDE80F812ABB77 5C1C3EE1B00FC628 79DD9964B3EE6D9B 2D875BE07CF6E2FF 487B4CC158B2F60F 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4c94e6c4-1de2-4ccf-8683-4e89f3b2d1e3
  2 32837e65-fada-7e6c-b006-9cbf8c51f071
  3 c9a4e5bc-f36b-7832-b022-d8e73acf2462
  4 efa6c3ea-5632-4f59-ba83-507ee04c8fd3
  5 1440871f-3f57-0745-af5a-705cafed81f7
  6 b241e3f1-c619-6737-864c-a5a67a499a2c
  7 3e19de70-76ae-3ae9-853d-8b1748968395
  8 b0c01bda-bb24-5cc5-8f07-26e22fa17f61
  9 af8e1aad-48fc-5f2a-9b97-60b8e2319df6
 10 8d34c769-6392-6ae4-8782-4be4645a3729
 11 fd7e629d-699f-153c-8fa2-2a6cece0b173
 12 340b2d41-bb61-7921-8e7a-ce3d227dc6ad
 13 6ac5ba92-a1f6-2ed0-8b68-ca7bdb5e52c8
 14 1c9bb986-d4e6-05fc-a9f9-0b06662ecc1a
 15 1c38143a-17f2-1060-b52c-c863e50148fe
 16 609ed673-3109-6ee3-b0c7-20fccd153856
 17 c7984f09-d730-7146-b42d-cb523435c2ab
 18 4bf91cc4-120e-1a3b-a2c3-62f64f856c9c
 19 38c0a7a9-99d2-05b5-a5f3-36bf17e5bf82
 20 1672b4b7-c6d1-0411-89dd-9df213f85fae
 21 70e4c5ac-5750-51d7-a080-687098a7f41b
 22 7ad09955-9bb9-6566-9547-e5998a71abce
 23 9b3e7e03-46bd-25d9-b060-22e6e86239f5
 24 4a26a110-2695-0c62-bca3-300495ff55f0
 25 22177fcf-8984-007a-92da-60a7bd66fd3d
 26 dee1db53-5430-530e-9dc8-68568b37bfcd
 27 ddddc098-1eae-2a18-be7d-2be17618498a
 28 bcab16bd-9830-66af-8320-ac4b857d5363
 29 51148163-d13b-3aaa-aaad-8c64fcc1c45a
 30 eab03255-6519-5e4d-896b-be8fed6449e2
 31 2621ccb5-0c65-651c-845b-46caafbb4c7c
 32 a61c779e-b6aa-51e5-a19e-57ed57355bc1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 47740635561720167100562005263565. Exactly this sequence comes out of new Random(126).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 109 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs