A858DE45F56D9BC9 archive

201305170109 1egloe

explained decrypted filler

seed 59

Metadata

Post ID
1egloe
Title
201305170109 → 2013-05-17 01:09 on A858's clock
Posted (UTC)
2013-05-16 17:09:59
Timezone
UTC+8 · title 01:09 against posted 17:09 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,576 hex characters · 1,288 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305170109) = 6ed8e7b984fc9b2008e6482fa7360a02 (name+title)
GUIDs
40
Filler GUID seed
new Random(59).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
28 · predicted N = 40 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

413B524DAA4F5C7E 48255A9E5D34E823 7FEAA48988B07B72 627CA5363F222BB5 2AAB4CA5456ABBEE 5EB8D6F53B1261EC 2BA4CAD0A990B7BF B31A97122839F7A9 BA160A48705D550A 37B1FA8496BAF99A 40085B6AD7E948A6 78B0829CF9D0B523 EAE1791BF2F7B13E 027B14D9AF0B117B D32B8908E578CA76 A8D914867C2405E7 B75CF9DEC409C32B E0022A0D6D367CCF D3F75298E90E20AD 026D4FF49B66D58F C8A0CF61B65C418E 04A818EFE1AD639F DEAF7F2A21F29BC0 485D14936A99B697 70F528C393B9D4FA 0E02A0F35D11C733 61D3CE757361421C 7BAB07D3297D6601 B1E9E15BD9623C6D E1523D01CB90D9F4 681E26766076C426 A66AE73A4838B4CA A82C47DDDB95A76F BFDF814B684AC6E6 AC9FE9919E280599 7EBAC6420F077957 69C1BDA464BE44A5 BBD74650CE7C3582 43249681002710B6 6D2131CD4FA80C2B 222A1698F48FA8DA DF5A87BDAC4DBDA2 B9F731940BEB4F63 9F54703032BF0DF5 36C37A5C37474C88 D1552D963C66ECFE F0F2CF689E561AE6 F175A6440E798DBC 6C6F1F45AF7BAF45 8090E7927B6F5085 21EFC8F2AA7A52C7 DA031ED11F17C9BC 2457A13C788B07C9 28CDF762B254374A 4465F95006F38AC3 7889A804E3EB43C6 A129342368D9A676 F1E9C57FB8798B1C 83A2745FA7FF0447 71D5BD82043F2DAD EE259912364C4756 9988A549A9EB7ED9 0A88DF0754284BBD 841A06A5B0B44B76 0BB814F4719CC3F7 040B0AFB9E93D505 468D6E1F4DBF9457 10B530803D940A89 305400836D072CD8 2E3F68FD8D232B05 9EB339311CD4E4D0 B9F8247E16A49212 C06CB5DCDA6EBB63 3473AFC9E207F06C 1E714761582C59C8 23CA436953B6187D 4B92B617D7944F85 BC62E221DA89C62F E123F48EDC266F2D C4D6287474A43A9E 7F92340B6F27C536 F03F4800CAA0B958 C68FF0F3EF8E2A89 50612082470BF590 057498071590B11D B5A881752CD6B926 2EAB6964172BE94E 459596C32AF14F0B D4AAAF4042CA3E9D 706B95A0586B6E86 E7880C3E9EB98AEF 47E18F695FE57FA1 17C1552FF0654D38 BDF93C9731668681 3E5B173465D80591 11A194FC45A5A7C8 0B5B1F9B6CD235FD 2272730B8E99A836 9900172958232F84 90800577D551CE25 92DA4891B38B44EB 326560255D120E52 0615135DF6C8AF26 8E050DA4958F0864 98CF1B465D276BF0 F7038364A8C701AA 8DDDEFC2F6C6163C C9754CDD0E9C9CFA 8F75E70AC501020B 55DD77B4ECE3F773 19263FE7074F373F A810C657AE390852 3B529B200D2BABFB DCF39F5DEB87FCF0 777C634AB79F2312 6DE4C56903332A3D 5BA2C13BDA3A3B6D 6456F51BBF743132 EB7451B079EA7376 D657E5412358C1FA 7C98BBFF08E7FDB9 86D98C2E44DC017F C6A07D889767BF32 1D8ECBDFEEF06B42 48EAA03183D72E93 A6C809135B70E954 5744B78893CF2AC3 6C4127BC1417FD4B 9033ABD9DB5ABEF2 B50BCFE701D39ABB 4BA0C115811A4B54 29FCEA683D53832A 80F8CC5FCAFB15AF C5F36659E7D0869D 6279A91EAE355938 7CC0AC3F2A829737 783BBF7EEF904E6A FFC26A2E21208B74 AF19A8283E178C9F 79BF71160DA0051A A65A375548448E3B BE51BE9FA93E05BC 0A1D55B021F37DCA 1D9DBF02E9BD82E5 1D3D04F17F446FC0 9654CB0EFEAA89D5 D9E4210F69A7B8F8 1A228CDD80F5450C 24D15D2E6DFC9371 2244D7A0F029AFB3 74C05642D660CDEC BADB3AF135CEC336 392A825C2C910734 4AFE02B07E941A6E F9467B84D4770152 6050C360A0049A65 08DC46269B423939 4E1D72C27FA041B5 246348568C405DEA 4777EA0EED048CAE 3D4A13A4D7F0E865
  • Read the ciphertext. Strip whitespace: 2,576 hex characters = 1,288 bytes = 161 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305170109 (name+title). Key = MD5(password) = 6ed8e7b984fc9b2008e6482fa7360a02, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 40 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d55c10a3-5062-4395-a8a0-ad5b5e7138d7
  2 e6fd2c4f-88ea-1e33-a053-7b0fc8ea6a74
  3 47480b09-18f1-0be2-9899-c1f0977d5cca
  4 b91fc947-9b2a-1555-ab01-e5552b7d09be
  5 af8f2d7e-d18d-7961-98a4-3fbffe08f2fa
  6 81f123a6-7cb5-13b3-920b-e1bf5e2a6e77
  7 958b4229-0266-3d65-8b06-57e1b872b8f6
  8 7360933f-56a2-02f8-b3d8-300a39de3b95
  9 fa129d5b-5201-2a0a-93c1-767fc3eaf332
 10 93faf671-9ab4-0030-a6e5-ca7d18a331db
 11 900cb8b7-2c44-6720-9f0a-da173b37ecca
 12 0ee7022f-ce3e-42d1-b7a4-f02db3011e00
 13 7d1d151f-7f56-1423-a87b-0487a912c7eb
 14 3d6b0665-ac57-17a2-ac7c-b160fe387028
 15 68c27083-0e5c-274c-a399-c589d0aba687
 16 8e435c24-7a35-7329-aa91-214c6bca56f8
 17 b15ea5cf-9f22-5de1-b0ca-a24c05fc0bac
 18 5b694e03-19a5-53ed-9db4-9790a638ad2b
 19 92744fb4-33dc-225f-b3ac-71bc99fc9658
 20 382ee84b-c043-17d6-943a-91ac7bc08275
 21 fad2839e-60af-5421-9096-1065196e8514
 22 e9abbcfe-6359-253c-bd27-880e1540883d
 23 fa31d1fb-dbb1-8e11-a81a-ef46b7098c40
 24 f564a09e-ffcf-539b-b8a6-4e5fe24ec25b
 25 40a624fa-69b6-44e8-a88e-93798ca13717
 26 121b7bb3-4cbf-4f6d-ae8b-10859cc37145
 27 420ae1d6-5e20-5a22-ae16-744417d31f00
 28 f7e78d73-abb4-235f-bcd7-bed94e2a0750
 29 5073cc92-0457-7e4c-b827-53c271f1bc83
 30 44629cde-b8d4-5bd5-93cd-6e9222761a40
 31 d84342a0-2482-852c-b282-1c053f6784d0
 32 e79d19dc-f6e6-888c-8592-b43564fbddf9
 33 9b64ffae-a11f-0baa-8cb0-f4c1a1e9ff35
 34 2fc3b8d9-525e-4dc4-a875-134b904c88f3
 35 d05d06f0-37fc-2d09-90ba-adc4ff458242
 36 bce9b054-26e5-2fe2-9634-7d3c856aa348
 37 51f0b815-2939-84d4-b6d3-905c4f74e8e9
 38 24c8d7ee-365a-5027-9146-87c5ecd9c0c5
 39 fd32c47f-5f2c-4f97-a7d6-249b972f3c7b
 40 a135832b-06dc-4753-af3b-e6f59a3f81b6

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4101713020641127552152854452758804228544. Exactly this sequence comes out of new Random(59).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 28 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 40; the post has N = 40 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs