A858DE45F56D9BC9 archive

201305162257 1egc59

explained decrypted filler

seed 226

Metadata

Post ID
1egc59
Title
201305162257 → 2013-05-16 22:57 on A858's clock
Posted (UTC)
2013-05-16 14:57:59
Timezone
UTC+8 · title 22:57 against posted 14:57 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305162257) = 3f2c69a26a7e17d1961eb9870a9c8b69 (name+title)
GUIDs
36
Filler GUID seed
new Random(226).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
25 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

9DED3B5713681703 1391B907961EFE62 82A23F15AF675307 3263C16346677A63 71D7F9E44C2E8631 B0AC55CF34CD7861 2E95874CDAEBB1FC 5615EE8C473957E6 B2F283BCDB975E9B B8157D9DE323DEAE 042AFFD9499BB52A 67E0F3E69BCD1814 84AAB06FD961766E 194ADBA3804D0FEF EFF25885479087FA B837D4DC844A64C7 46813F1BB5DB699A D8360C92DCE43F3D E1437327AC591E28 9B7BCD8A45F63D10 75932CC5DB25F9B5 5CAE218CF06D7425 541498914808BE83 2A0597FA9CD6FB5A CADD04B64B507986 3CA07E8DEBA76E8B 3F5FEEC9DE198294 70AAE27A87978935 430B39D7D61AA441 BAD1880BDA5DC619 3DA0C6617EEFD8F8 05385C2F54A41520 0B40202D2ECCA822 176EB0D9B938507D 76A946127F7E88FD EF0A101FAC648E42 2ACB411D51E78832 3BDD5130A7D0EE1E 7E1D54E3BDEFE789 142B6DE375B8F34A 40AA4E896D2390DC 2B34D26D88AA013E E44763995287813C 6F55D5B989F4BF87 B9D143A50EC77A7E 411E235AFCA4A427 E47DB414D920F101 CCA5A8B0E2ABCA2F 89A18D9526F82B60 87F5D313A007F941 E325C49BCB228163 35FCE619B68C865D 5935C9F08BB8EC29 35FB600338C80A71 A2FDDECF097D9F16 8E81FB915C97893B 0C7F7E5C7178CD3E C430009F04B4793D A238828AB778930A 021BB6BD9C6F349D ADEE6093946A6782 2733E3B0A3F21099 CF0714965D4441BA 3C914CF3E29F3E32 A99F4639C17BBA93 06E7686A5031031C ADA8792AA0F30DB8 B10CFB97B1B7C39D 3B8785513E01A079 F9269B9491EDA1C3 3EAB8A6AE4AFA0B8 078E5A562CAC1119 9B443DE37FDFE385 AE7691DA6B5EC369 36824360B0177F53 6979DD242468FA0C 97E11C0495E4D301 600655D7D26D9F02 62A16AA2EF7E0D96 E117BA0F33213F39 A9EE7C1ED6E34D3B F62115FFF865711C 359C904B81E39CDC A1211917C6808F20 83DF8527B4624260 0F539CF1EC5688F6 CFC9FC926A249318 7D9A5C1F08A604E0 C792B4BB14B40F3B 618FEBE3E88C9B70 86DCDE1AF4049538 97C884F70D6411B6 887439DD4D5F2FBF 8F70D2965F532A2C 4D94785601DFAAAF E653784E61823571 453D611A0076F5A6 4895B07F8B56428B F0E650CAC88F89EB 63CE16B9C8BF6E3A 7D0F23D282C1C8D6 0BB475C1CA8AA616 5E4094FF277DC320 BE2876CE4E4BF7D5 5A21F5CD4912E18F A0376EA84E3B7244 B434E7EF397482FA A5B29D430E763D0E 0880986C62CB2F24 D8369D29CFF2B214 A1221E65D66460DB A5951B3D6615578C 93D80ECCD0BBF0EF 090C323CE9DBDCC1 E42938609FFB2DBB A1595B3AADB81F0C B44A19CD5219D228 4708AFFAC9927F0D 7385C0E865E3FB8F A5BA5A9267B95094 4A103C8857334CF0 6738355271A856AA 7A82371EA6F9EE88 9E01E347E53552EB 220A07B70ADA8BE1 538F77AE5F9E9DBD C1D6A12C6239ED7C CA66AABA933F3860 FD0AE1B69356378B 20B0FA5027750BB7 60448FDF688DAFE4 B14CA7CBA9DC39FE 33522AA11E4E63D6 984ED50505B28A7F 1B817F256023F1BB 1BDC6B9985BC7A9D 5809D073820885F7 26F63C5E97866D56 09248CE9EECE48EE 25C83BA9F4898216 6ED3FA5257E1FB94 2FA7D3B41B32A7C9 0BFCA9B91C16BDBC 89DA83CCF83B5CA6 E2AA4950A215D6C4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305162257 (name+title). Key = MD5(password) = 3f2c69a26a7e17d1961eb9870a9c8b69, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9384e37b-a3b4-7fb6-8216-1bcaac2d2206
  2 7d726094-162a-1c20-95a1-f41d118fc91c
  3 dc28e12f-b5f7-63bb-86a6-4ba67e58c58e
  4 d4e2d2a3-1f97-7b59-ad9b-72ce3ba7fc6b
  5 4d1dd629-763c-2f86-97a8-eba7d5833a6a
  6 e263fd8d-e740-0e9d-90c7-480bdcd3d11f
  7 865a61ba-2389-1587-ab2f-785de9f8effc
  8 9eabdff8-5e49-7318-8ea8-4a00becb4fa1
  9 673e9289-b192-8a89-864f-5d89da9eacd3
 10 e48dcfa9-1aa4-5f58-84ec-2fc09e3bdd3f
 11 c51d05e8-d5f8-7dd5-8ab4-e6d58f53103f
 12 aee83141-2fa1-8c45-81fc-66dc0d6ca36b
 13 fc7a07c9-ae6c-857f-8aca-40200125a875
 14 41744c87-0699-04df-a3a9-f2e4499b5ad7
 15 45ad29f6-8e8c-1324-839d-0e7340bd907e
 16 c9943a74-a1b1-1887-b46b-175ba8c7e7cd
 17 02046069-33d8-7761-b5e8-6d8e3f43a850
 18 81528933-0e35-1776-96ee-14f42b7a2c6d
 19 e38f6a30-5cbd-7913-a0eb-25acd5cc8bc2
 20 4d51a8fe-8447-75a6-80db-75bc23a163c0
 21 84dd59e2-3016-7eae-9258-572a6f7c5477
 22 c0761f49-d0ac-2246-8984-226d6b2a434d
 23 ce25dd9f-4905-10bc-b7b3-38c076b58b72
 24 779b369d-37e2-8d75-8a16-1b394f066818
 25 5571844a-dffd-77b3-86b1-0179bd989ae1
 26 a8065957-a4cd-71d1-9dcb-0903813f9227
 27 b827844e-318a-23e8-8170-81a6647131f9
 28 22310672-384c-663b-9fbb-70fe03adeb3b
 29 da6c5ded-3223-8272-ac8b-b1b84eb1ad49
 30 ba9d6604-1de0-0cff-8bfe-b4aec83493b6
 31 dde499e5-7532-534e-a46e-8f3cc7bba22d
 32 386507e8-bce6-8d48-bd0f-dc205ea8d2a8
 33 458e9951-dffe-1ece-aaab-5ce213bfc193
 34 79328f5e-263d-5748-b742-1622cf60838a
 35 b8c469c9-7c49-5643-840e-4ca1d5e0870b
 36 319d42de-6ce0-5dce-ae75-2a53cb27c69f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 716720178578801171777218772680581555. Exactly this sequence comes out of new Random(226).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 25 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs