A858DE45F56D9BC9 archive

201305191355 1emafh

explained decrypted filler

seed 228

Metadata

Post ID
1emafh
Title
201305191355 → 2013-05-19 13:55 on A858's clock
Posted (UTC)
2013-05-19 05:55:57
Timezone
UTC+8 · title 13:55 against posted 05:55 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305191355) = 098e915301c51e40e0211222ed5c2e37 (name+title)
GUIDs
32
Filler GUID seed
new Random(228).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
39 · predicted N = 32 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
12 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D0891EB70BA411B3 3EE8162F567E0F8C EA329929492F1AF3 A5DE315549FF73A1 CB469F89AC1A1D77 04FCEE47C4CFDCBA D5D37E419F9DF5BC C122D64DAA881854 B1FA37174F3F0040 3ACE268C62BDA262 833C11CD6B1E3231 F9D61D50491A2C6F A2271B43E670C8A0 AFFABE7EED86B13A 44CB969C8D211F05 BD990C99450A119A 303D3942A48AD59A A8972747C7A1D426 ED821337AB4A2FD4 3D88B5971FC0EF79 9E4D163EAEBCAD1F 1CFBB880CAB09EAC 498F30A6FFE1466C F9910D9EF0AE3EB0 DB40999B4B9CB137 116A48CCA2C92AEE E933AD30CD589219 F61D19D81862F81D FCECC6CCB609A824 B677679AC250C876 C8E161971DEE9C24 F59744875E74B063 B0F5C82608CC6F78 90C1A6220FD64185 FB61AFFF7F9727AC C99959A8AF92F8C9 18C3F45FAE67207D 2C19215D2D5750D0 C7B7CA6F7D416E96 09882CC16A9AED39 F4C3FE9460679CD8 1BE056530F00E989 CD49CA8882F9E2E5 050FF40556AC4B41 050C14DA59BAB358 4D5714CA1CF41807 0F66A6FCCA07BCD8 5133535BE40B07BA C528C2083BD2493A 772D738ED0939FAD 98B9B2CF29489036 E7B7ED187E5F25DA 9492EDF59CB4B88B E1DBEA3DA69C5D6F 0B6875165C3EB7A7 2ADD33D26BB8BC8D EF2D3D86A91876F3 D88161D8060FEBAF 6EF21BB44EAB2ACC 8345DC40D532F7D0 1E9A7A6FF1012A9E BA839FDBD31EE9A6 2F028DBCDAF656C9 85BA265E6F89164A 2180A84F095454F7 E1F79CC4092ADF0B E6E3F8F9D24B3C17 23B951C6519F15E8 E1A17245955ACA14 12FE0A7603369D44 58E89E7AE5C9C0BD 81BE09FA4351D876 ABEB39A13E46BA09 7E5EEBE46C751346 C0B9093B42A715D5 173EA7C2BDA48A56 15543597FBC0FAE8 18E7A379EB77A16B B369A809DD70B021 379019AB36886B63 94E0B1853749F5F8 D45637AF64865B92 504B72CF597DFD8D 6493F4BF0FF5F2C9 80F72A411C9064F8 0C954E7E2F04A549 19A624E1D29EA8F5 AF7705F5F1C46E9D 54D9777C0F683DD0 1C23C46656DF166E 5D79E2B68CEC287E C400916FA58013CC 5E2ABE2956F7C246 425FE61EEE99C0B7 BFE15B8F2CBC3C22 BA7F0EA30640DD18 DEC4BE696E30D64C FA7ED54A318AC795 BF4F1C42A46F4D34 95FC302FE859F9B4 E1677760D24FF038 477E2E3DE567D548 D89A6EC4386564FF B17E0BD56C6F7D08 31D7B2D91BEB79CA D5BE1D030CAFFBE3 D4ABC286694E278A AAD2DC1EE7E87D26 29F8F191FF4D06C0 59B81ED365EF7B87 8835F9AFE8B8092A 345B3AEBA7896FF8 D421FFFDF9EC0290 354FB1D6C589F556 59937321444F4211 26604F9A8A0A4F2C 354E8DD3D21ABBB2 D94E7826371A0B1D C17AF03BEC52D60C EB13D50E8019E363 792D9C37949F8ED3 357E0027D18012FA 2111694B83C0F233 4476F6BE9A1FFB8B 20D0F4ADB8BAADE2 6F4B135F5C510616 69E885E701BA1BC1 86341791CE0F8908 60C33462D15AEF70
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305191355 (name+title). Key = MD5(password) = 098e915301c51e40e0211222ed5c2e37, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2239d8e9-37e0-7d4b-8619-3af5f7b30c44
  2 ca3ee7d4-979a-6071-a485-cee100e06d2e
  3 87db9472-21e1-1bcf-9d1b-0fd8cfec715a
  4 86ae04d1-98af-2832-9d18-db7e4b768b49
  5 f6797249-87d9-166c-81c8-aeb9b42e25e5
  6 9c8b3ee9-1eb7-7660-8d1f-5b8f76808776
  7 421ddcb3-5c97-07ef-bd4e-b16a29cb8751
  8 01c25fb1-d852-73c1-9ad5-173d670390a8
  9 e068770d-4baa-1150-81f4-6840175fc56c
 10 21c464a5-4461-336e-a591-7368687592bb
 11 0677fb23-3d4c-22ad-9b3b-f9816b79ac48
 12 192f1481-4436-43e5-bfac-8b82d6c04821
 13 0b88de34-4146-3d2b-a1f9-66b894f243e9
 14 6dc6362b-5646-0740-9f65-e24233f37801
 15 6915253d-860c-5022-a36d-c731066526ec
 16 c38594c4-da91-35f3-9667-b9a4ed260fed
 17 e2655ab2-fe70-6b60-967e-2dac787a237c
 18 0a0c2fec-7931-3f0d-8d7f-cd4a1c3d6de2
 19 ee870c1f-f305-710b-8c35-e2210414ca1a
 20 80ef1bd3-5d2e-5640-8118-75a6d75ba11f
 21 ea272a05-d972-132e-93f1-4a9f0bc95e1c
 22 4ea09242-fa2a-7757-8349-5984ffc8c5d8
 23 364d7723-74ad-44cb-957e-d954f3033ba1
 24 b42449be-b1bf-6144-b144-dfdc85c20b81
 25 1b56f7f5-8cfb-0957-8fbd-fbd18c2d77bd
 26 ab44122e-57dc-168c-a877-9eeda212dbe7
 27 eec3c738-0e42-80f3-8e35-11f22ed62d26
 28 2e55592e-d4dc-8152-aa48-5a29d68f98c0
 29 0d2d42f1-a975-434d-b36c-47ae57dc8db0
 30 07af17d5-c9d0-6e58-adb3-9508755fd652
 31 0dd41ced-b048-30e3-aa66-203cf247b5b1
 32 255dfd8c-7ef8-4001-b17d-83117de2f283

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 76121707132430536375174601884634. Exactly this sequence comes out of new Random(228).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 39 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs