A858DE45F56D9BC9 archive

201305160522 1eeq1o

explained decrypted filler

seed 40

Metadata

Post ID
1eeq1o
Title
201305160522 → 2013-05-16 05:22 on A858's clock
Posted (UTC)
2013-05-15 21:22:00
Timezone
UTC+8 · title 05:22 against posted 21:22 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305160522) = a19fa28d49544461777947bce435dfee (name+title)
GUIDs
32
Filler GUID seed
new Random(40).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
1 · predicted N = 32 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

BCC26EB6410AB6B9 6D444C4F0CF83143 B6D9FEFA09F916A9 31516654DC97F368 958910B6DD95ADB4 583B1CF687A893C8 ACB723B945774D81 5BBD3E79D4426A97 54A732DABA694262 1B738879E3D53A7B 50181FAF06EA8188 520141712BE9F7F6 D9BC97B2D99C405E B69DBEB628EE3E0A B8DAF0FE8AAA65CB B57E18BB70C5DE62 0A25FB0F4D61EFCE 52468FB62221C2AD C0E88E998C4A8FD4 8782C1D251594DF2 68B18098C0F3AB98 3733F41CE8582334 BB2415CDCC22BAA2 5E816DADDB7E2DE3 42AAAC9503057E7E 44F7F13F8D240D45 E08EBEB6AA13BB1F 4D3818F1E5199CDD E0191B6984C86426 45D5362C30C7B205 3BA868B22F508930 CAE5933026CEDA47 0811AF37519DDFE3 CB806EB35DBFA82A 2A9421F2B9A31BA2 8A59477D791A96EB 4DDFA6F8F6BFA418 7480D50F42C7839C 5D5D1255683BF5DE 104F1B8CCCDFEC84 CC8FCCBFECC769FF C262A4FD26077697 F21B294C8E15C14E 5AD63A6552890D2A 3A489F7EA87BC25C 833C9285D9C4255D 093679326F0C11A8 DCE39803FBBEA291 A60DBFAFD6363263 E63D52BDAC226745 C43E017D2336A5D8 CE569F53D9F3EC86 78C27A742BC7FD28 E4E2D5A47EE3FD3F F54AE574A75DB19E 5272D8D8475B8D9F 7C009AD0D3879F9B 52BE19F2523629A5 A69AD8FA6B2DBA67 8D427B85B5BE7873 3BA28DFCDE34B1F4 D02870096AB49F58 84EF3187D1E0BD8B D8FBA82503CC6FD8 08FE1F03F5C0F791 1D6B75CEB863FCD3 1506A5A09089EC74 8DEEE88F49312790 50FCC345C0EACB35 3C7B7CDC52240399 0E832CC96AAEED3F 3A01894D0281FC7E 00508DBF070B8038 E8FB2C14B483D7AC A600209881F96058 354B120AC55757B3 FFC7CD793BD163EB B238DB4AB8E305E7 56799F82B16C0CE9 A1636307F8AF3008 94D257E0AA693EE7 68D75C2866BFF192 143B31458F97F6E5 4A75D3D2849F9B50 860BAB6B7F85E804 A41D0BE07DF377BC 8F9982DB92C4A139 45CC66A4A8A3EEF8 2EBC5A50D9E7E9CC 46778EEA5321D614 26EBE24ED89E0EDD 1EE99965343B328A 77FBE765F2AC7D13 5E830F5D39CD8A9C D7A18FF6ADCB2A00 14A8560B1303A03D 940BD0B7F07F089E F0EF87A4BC7541C6 608808CC493E8FCD 6C1D78115389F85E FD23AB2CE08FFB7C 8938AFA8FC5BD283 BCAF83755ED7E482 0FC2A290DA46A822 F0E522875A53810E 19C9A6B4CE168290 EF8233BE23B24EF8 FAF20780C44311DA DC107EDBB26FF85A 441BAF31ACBFD7D2 CF6308DDE8E93D0A 23CA792FDFDFB459 CC84B743E123CCAC 17A82EA536F39C3F 8697E179966E4BD7 1E4E988564E7727F 5B72CB4292C64E4C 6F5D217974197BC8 41A2007A397C44F9 E0646678EC1CBDCE E691857DCAB7DF63 4291C4720A1A3595 B68EE8DF3656DF3B 8253C9EEB55EFD6F EF9015D4B5E4BA09 8BF6310C83317AF8 73B234838AC08C50 7D448EBE42C25950 EF945ADA6240D553
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305160522 (name+title). Key = MD5(password) = a19fa28d49544461777947bce435dfee, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 66172d85-ebdd-5c5c-b3cc-b09a962199fa
  2 25ce1e89-2b40-4485-9143-a2999a91553e
  3 31dedd1e-c5ab-61f0-a1a4-fca80b30df6e
  4 43c42098-310c-0c03-8bcd-d873ffc71973
  5 ac46c299-1d4a-2b19-9272-5c1d48b23f3b
  6 1945af27-c349-4ddf-aa6c-e7bbfcddbb09
  7 32c0eea3-b3b2-763b-a513-a6b19eb3625d
  8 9cffde87-ff55-4eb4-814e-b48d4bce859a
  9 07a4946f-e273-8f7f-9134-a2175e4e67b2
 10 3bcb4bb6-cf1c-0476-9b28-37bbdd0829b0
 11 64ce49c6-8899-659f-851e-9d53865f683b
 12 773814af-b876-66d1-9653-ad7dd7c674d1
 13 1538770e-dac5-14f6-b3fe-0c32b8bce0d6
 14 677d8e2c-c4ed-2a54-86bb-de39f29c4804
 15 d6e1fbaf-65fc-8c1f-93c6-19ed71dec66b
 16 b01a4764-cdd1-023b-81f4-e00ab18634bb
 17 1926f845-e387-67f9-ad25-bca638beb47c
 18 fe4e9c63-8296-7076-a4bb-b2a6a77af34b
 19 32d71660-38b4-6ab8-95ef-9f61bed600fc
 20 2fe0969c-9bbe-7163-8f62-6d39a5a53dc5
 21 41cef55b-a948-18c9-9a3e-1ac01dcad903
 22 cfe7da05-a486-57b2-b4ca-89e7e9825fad
 23 f0c9948f-f714-60cb-86e8-52be7417ef0a
 24 4d8adb89-b765-0d21-a179-50c9e803a94f
 25 a22ddac7-87f5-5af4-bdf6-93efd84eacaf
 26 1e6012b9-a143-2434-8247-1ce113f8145e
 27 489b1059-f31d-2bd1-9ac2-7f7686ffa8f6
 28 52a08f07-80fe-49f2-b417-f9190863f514
 29 c671cbe3-e55b-5d8e-bcca-0648308e2e8c
 30 d7d66f5e-5b18-2cb8-99f3-ba428cd4daf2
 31 031c6bdf-9014-8830-a65c-8822ff4835fe
 32 9671b8f1-2cce-8a9c-b06e-7035fd7caf87

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 54602474806612806767156052245288. Exactly this sequence comes out of new Random(40).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs