A858DE45F56D9BC9 archive

201305160817 1ef3gs

explained decrypted filler

seed 961

Metadata

Post ID
1ef3gs
Title
201305160817 → 2013-05-16 08:17 on A858's clock
Posted (UTC)
2013-05-16 00:18:00
Timezone
UTC+8 · title 08:17 against posted 00:18 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305160817) = 6a570a2d9d16c7cac5479f8ee9638686 (name+title)
GUIDs
36
Filler GUID seed
new Random(961).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
5 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E3313047A2C31D2C 72F12E7BBC1B4ED4 231A783BD81C6411 1D09B157B77623AD 3A20C98A0228249E 0406B7E36D7A3911 30B70644508D81AB 140C4425390CF157 A896EAAD71BEF79D 67E6BA4423A20238 3ACB8CBEF00E4A26 E0C67328519FA808 3387824835D8A92C 37C1A22EEE7667BF 87D4AD739D5DC5E3 4B4CA4ECE57CC869 796E8876971E22C3 FB511AF37273ED00 8D40DAE43387BC80 CC61C3026B733197 49FBCB466760B598 DA8151D0C9503483 DC67A05C4AA49EFB 70686479886289BA 052ACFEF48F84BEE C79B3258AC7053BB E8A29A1E73D8D471 2936342E88D64186 539E68E8009B3A9D 332E48C27706D134 CF02B598D4FD09BB 59CFE72008DEB240 13306430A1324EBC A065C37D4386A46C 5975FCA85E9E1855 C12271A0B05B18F4 141E4939E645414E D1B45F83342E57A9 0C1842F6600C7332 51A2827CEAF1A377 03A9C7548386B1C1 4D03AC82326F8BE9 447A6AEF55FC678D 417E700C72E08E8B 6EAF55D2EBB33726 46B8C4D970A18A2C 00A38E987347E0E3 DDB6663D2A736B61 3AA5859ED964EB99 15CC46A656926879 D83366733BAF2316 FD6D7893040E155C E4A78A8EC08D2E8D 4020F194486E1F89 FDE5AE793F7C741A B127DDA5CCCF7A63 55A6A079A1E10EF0 175C49D17BD734CE 36BF252858EB8C43 225D4D8D37145E59 48F617202FB2518E A942B45F38F30C61 53C4780F68BD8A34 677DD99F74ADDE10 552F3C2F980E8258 AB7DB747B4C05CA1 C917FFFDBBF81F07 BC26B41DFD69ED20 4152602CBAC49397 3462CAF5AA46BC2A 61E7856E406120F3 47AADEA8904A796B FCD997D99B968EC5 879CAB7BE8E49C16 A1944D2C1836CBF5 2680464300B93E1F 8259101967025E45 582BA4D64F79952C E70818DED0E8DE25 6D04ABBC09A95F4B A4177DC91E0972C4 91956B610EE2E233 0EA1366315E414A1 1605C307C9ACFD5A 6BDBE1E3D9E8C405 C3330E1387CDC650 8C8F57B912EBAF06 BD3BEBA250C2D3ED 2DD09B47F5AFC880 CD6B0E217867367E 6C30A6C8905D90BA B2BEC79DD005E6FD 3F7E19B95727B66F 7226BCB5E99E6F34 1BF9406C85386B96 A4F9D614C4017A33 EACD7A03E1747041 632DEA05CF6FABA1 CEA4A5094DE95733 9D11FCC9607800D4 8DE21E1405C68E4B 201702206ADF2FCE 5C1EEC97F0EE0AB3 DBDB3BAF467CD8BF 601870A113050280 9276410ED9E3583F EC6DF37ADA20DAF0 105D30AC64EDFDAC 69E7462219562CAE D0998DE702A33F63 A58D1E6BF46297A6 FBCD09C1E25E109F 39729CFAE20B4189 E2F0B1F69BDBAD64 FEB103F64A47C689 6AFC6B34924DB567 BD44AEC5598FAD84 D8E2BEC7E303EE78 2760310272152C1E F43D27450676FBA5 2DA08A5BEFE83870 18CA29B15B627630 8253AC5B2AD1350D 6FB60027A577ABAD 21235A92FA49AEFE CFA7457E7F53D6C8 92E11995636706D9 AF4784A4A8869ECF BF7811EEE0C912D9 B2CB0EB9D9A8FBA7 AFD4F4293DA252DC 25C09C18052E7A96 0D5C6622CE782131 EDFEA7C5E35DC9A7 7BAC552BC3ECC854 8A2C506BBC790F01 CA257303CF1E62E4 93237F3BA3E50FD9 40AFD34626DB6CD9 0C9A8D6E77523B78 8BAEF9BBA831F4E5 38E425283FDA4682 F3DA0C99331D604C C1D7BD6F3E1DBB0A DA1BF98FE5D45DB1
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305160817 (name+title). Key = MD5(password) = 6a570a2d9d16c7cac5479f8ee9638686, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4f5b12e7-c586-678a-bbb7-8b1def745abd
  2 c8da8dd8-f659-73db-9e99-412e17246451
  3 aad46bd8-1772-4545-8755-0a4a3fcfdf65
  4 abbc5070-3554-6c7e-9088-d427a7694438
  5 3b4d1f69-dbec-0888-b94d-a4f554552097
  6 59b0d94c-5efe-3cd3-bf15-ab338ed97344
  7 90ffdffb-6b9e-4132-a5bf-34a8e81ce6a6
  8 8630b118-e0af-5799-82fe-8ab576b9b113
  9 3e552b97-4645-763e-83e0-94d5eff80cc9
 10 3ce06e49-75e1-5b7a-b950-cd380eb74728
 11 db24f4f5-e5d3-2282-85d6-dab4b1c4e526
 12 820f3126-2999-6455-bf12-c83479fd0ff6
 13 8432fa99-cff2-26ed-babc-7edd37419135
 14 b111952b-dc03-3bdc-bb99-a751ab2066cd
 15 7f20bf01-2b22-522e-9136-040014bc3844
 16 c19621df-9564-1dc6-b552-f887ab850dbc
 17 5684434d-3ec8-7ead-bcc4-81037a776bb7
 18 d65c3647-c261-7fd9-8d99-0ccff7a01df3
 19 5eb0c24b-06d0-6526-9547-2a59c071d21f
 20 8114a2d7-57d4-32aa-8d6c-c3395da8b631
 21 2ce3f503-132a-4bd0-8593-793d90cd2c95
 22 1baa657f-e32e-5428-99a5-b45aa551ddff
 23 e4eae32b-8a11-338f-a047-d3ed34255e56
 24 8dcd0550-309c-651d-8b5d-60d93dbf4894
 25 f4fd011e-3e9c-78e2-8c3b-e817deed3211
 26 2423842d-a55f-5fe1-9185-fea2f5b3f0bd
 27 849dafde-9d98-15a6-ba58-00205439a460
 28 d19e9d35-8989-1d3a-b764-b1d2650d0b5d
 29 75098d35-1af6-8df8-a29b-6acf3a63c453
 30 475212be-12ec-065c-801f-4887b91daddb
 31 80ba1b21-da09-8e9c-94b3-d707dda59f6f
 32 3b98a169-f287-5a08-a394-d525a9188dba
 33 7683c955-cd5b-6d21-8814-4c9a7cc63f83
 34 d90da151-2bec-0803-9cd9-2d08f601c2d8
 35 9d3b1540-4b57-11ba-803e-977c87069f5b
 36 fb695b06-3026-39fd-971d-b30296cf903a

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 674603457526235177634536751180856013. Exactly this sequence comes out of new Random(961).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 5 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs