A858DE45F56D9BC9 archive

201305031505 1dlv6p

explained decrypted filler

seed 838

Metadata

Post ID
1dlv6p
Title
201305031505 → 2013-05-03 15:05 on A858's clock
Posted (UTC)
2013-05-03 07:05:33
Timezone
UTC+8 · title 15:05 against posted 07:05 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
36
Filler GUID seed
new Random(838).Next(9) ✓ verified
Run
Run 45 (seed 51,450,859) (seed)
Draw
147 · predicted N = 36 ✓
Machine boot
2013-04-10 12:46–16:39 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

744F1C0651C1C085 22E1905F4EF659AE 272D44302E15381C 0E7B78F31870184E 483332697C1AF789 2FD316B1D849298F 912F042F34CB88F3 2C454DE498313179 172B1112E9716125 DA0AB2F0346075E5 19C1C1880FA60494 EEFE148052C5B082 5170C3499117CE60 EAA5B26C99EAC099 A97D02E0C28B980D 1AE40D1199356396 50BD9A8EEA030554 23A03AF86065852E E34CE125D58C6DB4 13DA44A0D3EA4E8B A89462F3497A025E 089B6FC65E9251D5 1C94CE6FC91739F1 E6EDA579382C02A2 496E19DF34392EDC 52927F2373E54F61 4F04F0140F25A06B D3D2BD51B792BB0A 33B773632D9084F7 689BB39C45138532 0C3E2EDF66DF524B C9FC36523EC41D07 DE214C5C034E5AC5 5F8FD9C1F1A61491 D5997247F07A6DF1 630EAE88C9842B2B D8106DBD313B5B41 62DCC32FD2DAB49D F6C07BFE4BA23F71 F772A26CCFFA15E4 96A16014543570AC 4461D41718F8FB94 E7EB350F5AA85EE0 C4CB160E2C98F87D 7584DAAC2218897A 3BCA88C888264F4D B68D2BD77F032091 281C05BCA006D5CF AAF586DECB427B20 1FBADE4233DA84CC 418951969BBE56B3 71FB0114347C1686 8A6BFE9C4C59A46C 1F634B6383401E0E 38D844B5CA96F5B2 CD905FC65E8F374F 66A0A26EFC7DB9F7 71032EAAE1E3739D F4953DE51FDD78EC 40B34A28F2225A15 EC9C3794E7532124 3C2149115C9FD7A0 402C1A7370F560E9 91405EDB8B449A70 61DE08415934A19D 097C59C22714A906 85F980C6518DEFCB BFC5AAACAC476FDF C5E00C206A0BBEFE 24DAEA699B9463DA A32E4659EDF56BFA 8503682775D2A4E1 B6956592A1609C10 68D497F0FB72573A 9BBCA6330D3A146C F6E05DD6D90AD338 71F9E6C626BA8C88 122C4FC5582F3087 51FED74264FBBA11 20AE66C595F71A98 461445C04AC362A6 1E8DEE04033D0205 8035C18FCCED7A43 AEC024EDC5910138 4A61BFC3967408DE 402C3D4E329DD50B 6D0A0638BFE7096F 009992282F613EE4 39CFB59557A1B224 2C543F6D8F201F03 A0A3231CC266FEEB F48081DC83DA12FE FB279FEA8A3C1551 B95D0A2E31EB955E EC693E22036EFA1B D7A93BD244268565 0E59D89BBC52C4AB 29376F07867E4B8C A4660D7D28A96B36 B5AB473073EAB589 E9A72A8AF2F48D5E 66DC9BF2469240A9 33AB9082F0A56D9A 1B3F1710D20CF543 13C74442D3CC797B 75CDAAD8BD9669AB 7F3B2576878B16E6 015F494954E5341C 31760319F8EBD9A1 3C8F84801A1F51AE 7A6B8EF8869693B8 2C18382D1060F885 EC22B765CAB09D5B 2F119BB4F7B9321E D38F66D90B765A1F 3D37146CB46BDA16 90CC55CEB360073E 6581F396358BA2D8 268E78D5416DB9A7 4B3C1B0C88FCDDC2 3562373A4652AB7E 29AABDA25068921B 2D3A152EAB523B55 FB283C3F044B5224 B154AE37FA3110F2 893E463AADF234B6 C295DDE278EA9367 12B438414728EDDC 1F91863EBBF7C94B 0A1AF23C5068583E 03DA5FB2D39EA152 A23D7E3F1DFB3823 FF9B0FD4E5CB9587 2B2D3AD57927C1B2 DF68DEE104E2C476 9F838727AC48BD4B 518FF1856F12F945 7462F3479F1E37AB A966842A948CAC38 969AB6310B20DDFE 294795C0A577B7C3 8AF77B711EAA86BA EAC6CCF123E5F1C4 36E76F411D991B5F 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7b6ccf61-38a7-41ea-8fa1-f4dda34d5e22
  2 44da6de4-8478-6624-91ce-fb9e4d7cc246
  3 1edc9d62-3a69-4338-acf5-adf4c96077a4
  4 dc024b9a-f146-38db-8c28-435de67014b9
  5 9eebbaf5-6c0a-4eca-9293-5836d087236f
  6 0b1531b9-a90a-75e8-bc44-9c9b1f7ba0a6
  7 ec6a9c56-1373-33e9-b328-daf787b86038
  8 113adfe7-6a00-7dd1-952f-eb9d2a0e7fbe
  9 c92169af-6200-5c86-9e79-7c9a980ee788
 10 ddeba84a-4fb4-2c03-b6f5-27ea98c1cc2f
 11 2f71cda4-d765-6022-9eaa-558fb9680d09
 12 d44986ef-ca81-6109-867b-9443a708b9e5
 13 3b66dad1-ac78-653e-9433-ad533516abd0
 14 bce07502-fdc4-3514-a81d-0b7d5838130b
 15 56b0d7e6-4032-5609-aacf-52cdf583159f
 16 096e0c7b-5a58-36a9-a233-9fbc2bd4912b
 17 a887a7c0-7cfe-1720-ab86-031bc1463b5c
 18 6727c8f7-e5e2-455a-a045-9b56df562140
 19 5c82debe-376a-3a59-8144-590887758a54
 20 2197f035-4f24-701f-bc27-8ac12c2df9a5
 21 81a45d0c-4c93-1ec7-9621-edff4df3244d
 22 ec4dfe40-2b2e-3784-b53a-6f395152bc07
 23 794e3542-fc5c-5b14-9c21-4b77aa36917d
 24 cdfc9ea9-c870-78bb-944a-b869e3952a3d
 25 16cb3aa7-88a8-768e-a91a-f50c1f65d2b5
 26 0a53f0ec-e540-4e44-926c-4706464ea97d
 27 3b5539e0-ab8b-372c-8480-bb338a736408
 28 59ae31b4-98d1-8fa5-a7df-c1a9fe2bc509
 29 958a2ce6-b567-0151-95ac-496eb22b9ec6
 30 4303bb96-fe8f-8154-b7f2-6b94fd33bba1
 31 6789a881-3411-551a-9de1-a68986f76c4b
 32 fd50b179-39fb-1b18-bde3-1d4f74d856d6
 33 29be849c-8b7f-2d44-8661-086039d2e47c
 34 5cfdb279-46d2-8bee-bb02-3bdce1466310
 35 84d4669a-3096-200d-a453-79b5c3e25b05
 36 054f360b-e144-0620-8131-1b8ec6f9b894

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 464347375266635314371357743808512820. Exactly this sequence comes out of new Random(838).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 147 of Run 45 (seed 51,450,859): new Random(51450859), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-04-10 12:46–16:39).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs