A858DE45F56D9BC9 archive

201305162001 1eg26k

explained decrypted filler

seed 315

Metadata

Post ID
1eg26k
Title
201305162001 → 2013-05-16 20:01 on A858's clock
Posted (UTC)
2013-05-16 12:01:59
Timezone
UTC+8 · title 20:01 against posted 12:01 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305162001) = 4cc692102573122bb157905139498684 (name+title)
GUIDs
36
Filler GUID seed
new Random(315).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
21 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 2
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7B5517EC36EB9FF2 16E9C3F325512F3F B4CE0B664DF99186 12D8140AF2A8711D 5E60D7CB9B2A2574 CDAFC756AD6684A9 02C6FE2489F9BCF0 988CD84BB1740BE3 7FAFB000FA2885CE 4A4364A140B29A69 3C587FC4B5A9EE16 D7AACC22281FDD22 F6DCD5B6FAD62887 78BFA348AEC90BE5 85752F870AC1D523 25D3DAA8C1C98AD8 01A7247CD975B7A7 3CA4D154C78998D5 842BF0FE2B6DC3C4 9DBD2105094EC09B 592EE1385AC391A5 EA42A24D2F5B2749 45E50C4F3E529C3F 454014C8B7C30E3E C4508CE4994F3156 07674B053015F390 F74AC7C344D706FB E18B036FC22A2393 509B9B81F7ED9B15 BDDA5627433D1E3E 73486F95FC3D95FB 620829FB805CE69A 3E27CD8BBEDF53E0 7523E1B7C032DB5D 372EFB947C356531 0A816B381E62933B 8493C1099054789B 13BC81AEC168AB35 2396E08342052A9A B0F0CB05C2E1533C C1C850D8BFFA69F1 79708628578C49AD F54CDA714A3EA3B2 73C7C6AD15353D89 7EB2B6F35AC703F4 1DBAF0C4D7D3C5F3 07B6558BEE94F462 CB9F6BE96741247C B6EAA2989AB0A224 6FBEE89E43448B63 DE773F260168DC6F CA86DBB2F79849EA 2C0FC217BC42F57A 4B9311E04519DDDD D48E4BDB927F89C4 B2CB86F3EFEF4D4E 0BDDA62E167F3111 7521002A50145206 F5C03B3D2179D080 0E2289713C65DA78 D2819985CAC4B3EF AA788BC5BB25F2BD 2872D0BA8F39E016 37DEF24DCB45925C 1512D08096EEBC87 C50950C83A3D9933 72871D354C457187 51C4F52C6B54DDDF 5E1B3FE8CAB87166 1CF77D1501087A31 2BB996D0173B63EE 6C7FD2FC71C45D3F D907E91BE035F34F 1F92C53876F8D44B 41BFCED11B326F29 7B0B6CACCADD5FF8 E78941B4083BEBFD D243FA152CF4FE86 08B41BF60CBD186D 796B66865B0B5637 5E3457B0B4A790B9 A4ED59CF4438BE83 213297BD93E29BB6 B5305069F2B1E516 62C861DC13E5EE53 0CC1ECBAADD1B6D4 D12D10E0E1649305 0DE65CAFB38A46BF 135D72F9C55F7322 377BEDB28011EF6A 27B1CD366B70E39A CC9AD71763C5D31A 6A0ECE561DE098EF 35D2D6C19388A9D2 554DE2F016D03720 4128A67443C714E6 1BA52E49A04D0D39 082DED59A8F6485C 09F107B577FC1EEA 526005F5A6006924 CB80A480B82565ED 004C2E3E531A89FE A35100A5326A7E46 2BACA88FDF023E38 93D03FF622F5A606 E77BDBFDB8A53042 2A8B3DD8DA8103C0 7B3D98CDABBB5E00 1AE35A6DC82F693C E04B7AA3CA43614B BCD772909BF0EE6A ED304E580B0F7E6D E83EF810CF0D60A9 432781FC0834E5A3 AD35E77DA410EB5A 338A234C1CA08844 4992673D54E51F4E 444318D86AB2C98C 8381279AE7C4015F EBE8BE598AFB3711 DD4B7D899745E3FB 207C8E0C030AA9D4 80D8DD8C0503EEAB 19F2B55EEB494191 911814AED564AEA7 42C4E592BB6DE1F4 8E9F8AD3D1C5C3BD B6E06FC053B16A4A 33ED5D5318D249B1 6BBF247B5E4FDE7F 756B173DE3028125 786DDF472ED808F9 BB375440C560BCE7 5D4EE12E5D4D9C25 83E276354112DA9D 302FAFF0E6B7C4A2 56FFCF15F853FF72 0BE7D91EEA899720 AD00B3FF3F3CA719 3572137B8F6D9CC4 8D3C3D78A1EC2698 FEA752C65B2E02CB BF7ECF0A2A75EAFE A1808CDF3F3258CB 75BA49FF325C3B39
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305162001 (name+title). Key = MD5(password) = 4cc692102573122bb157905139498684, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cab488ec-983c-220a-bd15-2068dc37ac55
  2 9e97ca40-e7a7-27d9-b011-e42271efd4f7
  3 9311efa1-fd42-816e-8c46-f06df038538e
  4 7c282a71-ee5f-7db6-bf87-c8d76e811c06
  5 fef58728-a91a-3a9e-b71b-16f7c65b9c18
  6 540a6b0f-bcc3-7a48-a910-18e007d31792
  7 1eb57baf-bb1c-06b7-ae1b-1b69e14dd7dc
  8 1374f675-375a-4822-a319-220b49bdbab6
  9 6b3ea471-9996-8c7a-bbbe-16a6560d9170
 10 dcc39b5f-bc22-3b6d-abd8-67b0e6825597
 11 8ce90f3c-87f0-3026-9594-f4e83c320e2d
 12 4403e57a-c8b4-3aa2-beac-7a949b605ae7
 13 fc5c59cb-df76-1322-a772-c1160ee7b6d2
 14 0c21cacb-351e-3ee5-8256-b6b88bf501ad
 15 7b02750b-d235-450a-a1dd-8f88424c02b2
 16 0e47c9f0-5881-6b28-a13b-0a83e5939ebc
 17 5cd052da-83bc-2dc8-a353-be2c46ac5868
 18 c8d91c5f-5cb3-289f-924f-f3d3ed550163
 19 aa7f3d9f-6f5b-104f-b0cb-eecee9e67713
 20 928570c3-89b8-26d7-8bed-3755280d0ee2
 21 33748a61-3b5b-6341-baca-8f93a3815d7b
 22 7dbcd3d2-267b-1a1a-a979-4d0bec547fb6
 23 f1ea7749-4536-2644-9f6f-e82063a67762
 24 a9ddfdb2-938a-06df-a27a-f180824b3b18
 25 40b4b946-d335-506a-a8a6-7d4a1c18a2bb
 26 38c71ced-baaa-1b6f-b908-f3827bce0b2b
 27 dc592062-f320-6330-bd0f-0fae78c551d6
 28 0ac697b8-44f3-72a6-82be-1d556bd66cdb
 29 3c7ab8e1-d7d5-4fb3-8e3e-fc0eb59a8f9d
 30 217bdee3-5c31-6448-a292-3968349f51b8
 31 2954230f-e813-4e32-a20a-dfda581fc6db
 32 b431fb73-43f0-32c6-bf73-6fde3ac38da6
 33 e51531f6-1d08-8887-a104-e5effc4b6678
 34 f2976a8d-2674-7f2d-b51f-0fdaeab8fc42
 35 b2076309-bab4-5c44-9655-6a58541c56c3
 36 5e9f71e3-d846-3641-9c90-a937b2d72912

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 228737048333134622126120516746438753. Exactly this sequence comes out of new Random(315).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 21 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs