A858DE45F56D9BC9 archive

201305161917 1eg0li

explained decrypted filler

seed 377

Metadata

Post ID
1eg0li
Title
201305161917 → 2013-05-16 19:17 on A858's clock
Posted (UTC)
2013-05-16 11:17:59
Timezone
UTC+8 · title 19:17 against posted 11:17 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305161917) = 5055198492e459f5cc3ef0beba6ddb9d (name+title)
GUIDs
32
Filler GUID seed
new Random(377).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
20 · predicted N = 32 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B09776C265ECFD9D 9879E672B37D257B 1ACC2069A11FCB93 079C86E5B7091CDE 5BCEA7EA07EEE936 588E33F0154F5061 DEC219C3CF7EF65A 398E948A0C362D72 52F8A2C6446F8B46 1BBC0B99CFE40BA3 53B2C4BC7C171F00 242BCBBD5C84FD01 E0DA0BBCCCF568AB BAC623DC2B137A14 4CF4A83DB5BE3F7F 0369D774171F31DF 433447D260EA2381 3C48C35EE687EEAE AC5A489986A185F7 11530CDC1A003107 0656746D3B063A4B 87518B3914EE4AB4 0EC099D8FB465987 D769E6815B2EC147 D2368C242F02407F 339E5EC9E5A87DBA 28F567DFE4CD7DE8 3C7A6A7C8876568D FA289AFB6EB7691E 3DC2D947B3DF35ED 2A9ECEEE6AA8E8BA 349E38226F6158D4 AEABB253870FD65B 04666150A3824029 13C582D426159548 5D1F7BDD118DEAE4 35E793DCF8BACB66 77946BAE7C2D624C 65D78B604E610EDC 17868E6BE06E2ADF DF66DD454F4B65C0 3DF4CB00753EA94C CC88D1262F1C2842 D946AD7BDA8F61C2 486EC28EC3914B23 9A4749F7B7F0F8D0 E0BA0CBD9EB29D68 1CE0968A1B8405CD C4A35EDA2CC42D28 30B10528823A8F89 5B722BCDD2A86F7B 21104C165D6ECFA2 B27C1352A637632C D414612CB58192C8 74A9C5C3A0890672 06FFFBB42B63E4D1 16F51D5E3B7BF1FE D7EF63541DC1FC67 9338CC139D639328 3D4C77A46CFC0180 2E826458FD7EB8B8 A6E51316F41577E0 FA8677F06E2EE853 257E22733CA0D690 BBDCCB3D1D4E7C53 0AC7FF71F130AB69 DB92D461BDA38C55 E521D94A24321BA2 4F8AAE8479B1BF7D 5EDAA440666D6E9F C3EC993892D0070A 2730CEE3C896888D 9C705B2DD12E7B5B C3A19D5A177CF921 E06E5DA2B10FC601 0772872C07A24C87 7BE4766CDEA9736B 32A58EB25A78751E 1872A554428B8AD4 2ED749F3F9744E1B 643E12B9986C134A F7DCEE81A88C76F4 884B2B0B19B7E5A4 E5094F0E14255E7C E5A5DC12A400E204 A29ED28D9EAE6B4C D6E2C7CB1168E5E8 D5F9540B74ED588A 3D1383C2F7FDF23A F4A4BDB365449DEB AFF765B76923511D E8DD964A2FD0844A A6054B27BBA8CD58 1897809AA944C966 F4AD72A5035339B5 0970C175683B816F 058300D8A565E52F BF4BF1E22619DC13 AA3BC364BBFA9AAF 9ADD9C0868FB1177 0C2F3A5A0667505A 1E216FAF6A040955 3D6C329979200FE7 C3D70C3DE589935E D99EEF6468165A20 6BE3548B67470167 82753371ABD47F98 E644F6B9F6593796 7D46098EA8A4919D C818747B2FD25415 848094B86DCCD01F 0153EB9C38F0C49A 2EEABEBE7C3A25D8 991DA2C32C96DA0B B6F5ACFCF92199C5 7A8D746F075DECBA 179926D9CA37F2CD 861D52C520B3DAD8 F7E641AA92A37F35 46F892173D058B60 1F236F99F269A190 925FCA203E0AB2EF 19914E7B53A09933 1D94554011A31440 C3BCCCD7A9C84490 2A23B823C6CA0A67 4F41C201A467AF8E 3ADA2EEE4416A0CA F7308D0923D343CD
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305161917 (name+title). Key = MD5(password) = 5055198492e459f5cc3ef0beba6ddb9d, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f672828a-548b-6706-9662-e97bc37c9c39
  2 9a60a595-f783-3fc8-8de2-56c9a78491a1
  3 49e6e68a-c2d9-2cc4-b9ad-37dc485b26a7
  4 abbf3b44-f5b9-0be5-8394-f42e68912456
  5 2e8a70b5-1d48-38d1-94db-d12c43bac8f3
  6 beac0c2a-aa51-0ca0-8f76-944bc7541f24
  7 d570f105-ec94-7054-baf5-5174291446f1
  8 ca0cf88e-2262-556d-8058-ff5242d99bd8
  9 aac6cd33-4ec1-59fa-9b63-073706065686
 10 7bb9ecb2-b3a3-2c13-a42a-39f0648960f7
 11 29c7395c-c5ba-0481-ac71-6e6cd9e8b48f
 12 03b05fde-f693-7a38-9870-739922570b51
 13 bc5d6960-094f-711a-8a5c-6ca347f0d03f
 14 0c0a257c-a947-5eb6-a3f2-31afe9896432
 15 552ed360-8a08-7fb3-9442-a952c42b2b3b
 16 d85d8a5a-8fdf-4c19-a503-586f10bebddb
 17 50f45c2c-1aa1-36cb-9412-c5908d163390
 18 f1f957e1-9939-6a63-8dff-03dcfc8e4e7b
 19 d8274c64-1935-7a66-906f-2e05da0d7a15
 20 a9936363-b880-2a7a-bd77-35d757c5bc96
 21 8a6fbbad-1e26-84cf-975c-440ebbc88081
 22 df9a5200-c160-37ad-bf31-47c07c0a517b
 23 38917999-22f8-6ea1-b61c-e23cc4d46420
 24 ced0f568-5ed6-62a5-9f1c-c14b48c00b2e
 25 6b38e15e-0a89-53a5-a87f-609b6f1de7e7
 26 637680f8-a039-0f3b-ac30-b0167dd2b792
 27 71f1afb1-4ce5-03d6-9b63-ce80ee27ecc2
 28 afbc336e-1bf6-2798-9555-2f1fb8347505
 29 036bb63c-8c71-6768-9083-a253c76bf77a
 30 57873f93-a11b-6fad-aa6e-e33b7c5356d7
 31 58cd32e1-7fd7-3bc1-bb71-2d6d96cbe925
 32 dc89c7cf-98c0-6f2e-9520-57617f45df57

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 63203075520775743672836650026636. Exactly this sequence comes out of new Random(377).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 20 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs