A858DE45F56D9BC9 archive

201305161537 1efto6

explained decrypted filler

seed 564

Metadata

Post ID
1efto6
Title
201305161537 → 2013-05-16 15:37 on A858's clock
Posted (UTC)
2013-05-16 07:37:59
Timezone
UTC+8 · title 15:37 against posted 07:37 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305161537) = b7d6d0b2df36d18311055778b0f3131a (name+title)
GUIDs
36
Filler GUID seed
new Random(564).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
15 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2B94F11CB5DB0343 54B6D52CCE93BFED 4EED97648672773D 89CC0AC96C04E290 AA4680985C6A4432 A150F96D50053E6A 109280859430DF26 D775E289BB78752A D0A8CE1DD9C26A36 CD58CA77397F79EF 448C24891F53F187 9F9F5D0D75DAA823 43DEE1CED35BA335 3DC38883B0B3760D D04F71749FD190F0 BD8E053D15DC93C9 A9FBD60A4E3D613D EA50C4218BA5CCEE 9B3BD5DAB4B823F0 963B038E7D48DF8F 7A956DF537E6827F B09B6ECB0D0F7828 A7076864B6162B96 60E42662B5D297B7 8CEC6A2B1E186597 56B94573CB4BFEF6 3C6D73D28DFE6F7E 71D11262A5C9C3AD 81D33E19702307AC CFC9E38BCF1B6B0F C4490B2290A514A5 C7CE6F7574B7026E 20CCE9DC73AFC876 2503DA87A0160C17 9BC9DE2457F588F5 1389FE7E99522651 3DACF520FFE3D10D B197ECF9E47C0E60 8D02FCDD969E1CEB E6EA8ADD0CB0711E DFAF9C03E6128476 14BFE43B73465B5E 8105E41107C05686 C2970A35841F9AF9 F785EACA0D2EF70A 9CD9999410E2AEE8 EFA238263798620F 4A5F74BBE7ED9CBA C094399F2D7EEC7C D7B2710A5A601E6D F083BE9EDE252E47 1FC2ABD6327CF2C5 50B5DB23FE948521 6F1209AD26F0A6C0 F3B0D29355E39B67 998231EE62174492 B32FA799E04F2A32 3AB21BEF3AD378B4 58B374ACBA93C89B 0E227C9753B0A954 67E5C07AB0A539FB 2A5ED88764E90F85 50C7D4515C42B466 E1812C439F30551B 0ACAAF3AB0C51F2B BCD10B9CD83CA491 6932EFEC22256340 E1F43A5F6C734C31 833010579E407DDA C296E857F38E4D1C 049B430EC356C648 371B47C73FF41E01 D481AA4F7B5CF629 FD1DCB97281B8988 5D99125DD30655AD 1C080ADA316DD8C0 3B4D5FC795F35819 9580B0632A02AF6B 80977D0D7165E21B AB94AABE4A07D597 790510AE17A2B218 E7CB1EAB17AD227D 6E3D7AE1B57CBFB4 AC4AAFB66C831DA2 05E83CA85CB17C8E CB8792AB16615989 5810FC6B32F63483 9CB61B6DC9A2A3FE 539E2FC162C5A48E EAACBEA0DA52ECDD 2A16B6E6C8994098 2A9E70A45882E7C3 B0D360AE0F790BD6 115C097375C79B23 9DCB7F7C74996D11 5922B6CB776FB8BB 916C398F48380F47 5B7A62001EDF7646 9855FE0F526775CC 978FAE6C2B6DF0B0 DB9D6AA15F74C6CD BA581153F51051C5 E2C8926ADB7AB411 AA924A800E650C9F 51328469639272FF 95E99E581D607546 90CBE4870B76D0CB B41976E5CDF9C4AD 0CC7E7A9708618F2 59E32296ECC073BD 5075C2F4BB4B5392 C5D7D7DD6A452FE5 C6C878977F840C25 7CE7AF5E641B2360 77EE84D6164FC53D 7EBB0D3E354BFE5F 20F9E827FF4D7C48 43954205087EAE36 75E090FFC48E4ABD 837A1F868FAF256C 24D34833ACAB5D0A 4C169907C47C22E2 3828454D172589DC 4990EFE8FD273A8B 566F7A3576D87B57 0930223E6F5C1296 952B0185A379E6E1 293A3715B6F455F8 FB1FEBBDA23BBCD0 24E6C505F00F523A 13AD72F44DCA4C84 010028F4F2E073A7 F5FF61AB81106E0D 1A1CF60C44CB1552 7156856B565A0D1B 65F48E76936FA445 2F68062362640DC3 168028F13D05FEAE 160961EC656CAEC8 626269E00AFF778D C08FDF43A73C4069 879205841ADE7144 FD2F7406D9E09DE4 AA5009C93C26FCD0 CF6C952ADC696913
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305161537 (name+title). Key = MD5(password) = b7d6d0b2df36d18311055778b0f3131a, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bb199b47-a3e8-36d7-853e-a350bac97b48
  2 f844947e-bce5-2b6a-b782-e522dde26a9c
  3 7cee44c5-3e42-8150-b3aa-755cc576a078
  4 0273ba09-fcd0-843b-9e9f-aa9a3fbbfffc
  5 5e348c97-1092-7876-9d6d-7684d1c40522
  6 fd57d65a-8d31-3665-af46-7bb21c5058bc
  7 1cf3880c-bfda-570a-b3f8-a4faf2b43be8
  8 a9481b2e-f4a6-381d-b118-35e222c3b156
  9 23d64810-7fdd-6ca7-b93d-f0639b373d77
 10 d134f966-6a80-2714-b058-1d7fefdc6a03
 11 8121e99a-2624-7ec6-9c03-0236c111cdf3
 12 5a59b6ca-ae98-7e03-a5de-8a243993a6b5
 13 63735318-26fd-30b9-a3de-f24b82853a63
 14 87d484d1-1a0a-8177-b762-7417abc852a1
 15 c40f6f24-10b3-65ad-ad7d-4e1f6f30b8de
 16 08e428fe-430c-2e30-b113-dfbc0e64a324
 17 e779c4fa-8e35-8c90-9adb-0485a3480269
 18 4c817fe8-52dd-697d-af33-52511cb6d3d3
 19 58f238cf-f318-863b-911f-28dbe405bcd5
 20 9a21e11f-93e7-601e-a17e-41c2b23341a3
 21 ba72d916-bc52-6a9c-9059-4cb71f02321b
 22 a8920685-6422-1941-a7d7-789da03788a9
 23 6d6b4be5-9e04-2acf-9bbe-d193c2e8e53d
 24 00d83d94-e66e-0c42-915f-f494a2569c02
 25 3c97808b-f2ed-8c7b-8af4-4d36b4a00120
 26 f12038b5-a2a7-2500-bb5b-536bdbe5d945
 27 76156c21-e38f-74cf-9790-cfc83f7e8a86
 28 1b895f92-5662-1465-8df6-b84a5a83eae5
 29 e1e44306-6caa-2300-8640-b8740b3f3cd4
 30 ebafe694-3f10-219a-871c-a6bc15f89d74
 31 329d132e-2f5d-346e-955b-770de6a52bd7
 32 929d30a8-a1a9-0b8c-aa38-cce75c6465f7
 33 65eb0bf9-3acb-0f46-9b8d-c3a25fcc06fe
 34 9a19c4b6-65ba-1704-94e2-27f87576f9ea
 35 e06c2271-3587-5257-952f-b25be35f6312
 36 bc0fac2f-d724-1c9f-8131-a5f8ecea89f6

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 328873536277386286866120827122300151. Exactly this sequence comes out of new Random(564).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 15 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs