A858DE45F56D9BC9 archive

201305221555 1etmon

explained decrypted filler

seed 380

Metadata

Post ID
1etmon
Title
201305221555 → 2013-05-22 15:55 on A858's clock
Posted (UTC)
2013-05-22 07:55:54
Timezone
UTC+8 · title 15:55 against posted 07:55 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305221555) = 75f78f284f3b3b993a6877d6f3a1e173 (name+title)
GUIDs
36
Filler GUID seed
new Random(380).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
49 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D588E60EF36B856F 03BFD12FB3A681CB D0DDD0870DD317F5 758D2D83031C4805 446E8E594CEFAD8F 95A50C507DE5EAD1 12ABB20CBB68FA17 AE5AEFE3CE39C830 CEBAD1D6D81D100C 074CCF5C2A420B4E 434F38C97FDAB38D BD912BCD8D820796 E9AC8759A2884445 A3A4ADE3163AE66C B28BB395BC9C3730 BEFB71A28E387829 AEB2C09963383A04 0DFA7C905F88C32E A049AC2868E38B89 04D1C614BDAB56B0 14F61168BF3F5D79 43533CF817984CD4 E7F4CDD393DA5A45 8EF07CA0617B4871 F900AB6F3DE036E4 B93B9553A9E5D5CD AF63D69491296CE8 F6E486338905819F 618C169580510938 45FBB11CBCA331B7 8E7A02EB9AE4C905 001D61D18F5647D7 76911B7889330D1F 2586E60BFCCC50CB 1F6CE6D76B9C1C54 A0AA29725161367B F520FE0D2FBD6A31 0C7395FCE81C082B 7899759B208A0169 EC0CF50C5ED7CDB0 902896251C3E35C7 98F59BEE6FCDA842 12431E97EFC97678 BBBD7D70EE868D5F 55436640544EE670 A159FE37BFB28422 BD733ED1FFB9449A 766837FB35574D5E AF1AEBFBD2E3170F 47C858477B255913 88AFD7807DC4E23B 5BA44E9293D1B289 3770CD72AF7C81F1 D39E132765857319 FD5E66245B38885D 0AE7C047A2F9D9CE 17C93C5BECE62D35 C028828CF8D7F55B FF9235628DA7722E 25940373F9015274 868328C61E50C553 74487D85B1CA0AB3 CE31E12383A30D83 6BB38BD431BB89F7 353F4D80F6E51301 DE4866577C20F032 71A66797A21EFE56 6F3411B87CDC007A A1411FC719252ADA 17A7B37D580FE05A A39DB0B03FF0B3FF 8C257C30B4988C12 31B3081510982680 5A1DFE071F8B82F4 E7B1C599AD338591 87C53D1B549C463C 388B91D525D7D797 A714E923EB3AF769 4A9464C7B9098177 3DA8AEB4310F226B 950D1C092A7467F4 77095EA5A8E15C45 0F0497A1EC3B36EC 74202BAFEBE95B83 5CFD37A19FB5A7E1 7D8186B7650276FD 9AC9C80FCF832418 270649AD3E96A8D3 19A75651AF2E9ADC 5F5F98D9037E2E91 0C00D62B9C9B27A3 BCF2BBAC89C323A8 0204766B8605BF56 14B6CE779DC67F75 D668F5C8B0712D7B 9DB2E45194798F11 2C0A1AA86304FE9C 483B2F86BF8F49BB 285132D62C5592EE 3D158B98ADA90B14 48C43E322213EF24 155E57F2C77A158A B5599E4EF7872255 CC1234A02CAA7507 A8DB9AF780125B2B 8D65E4DB288C22CF 074D25C1B2047946 11D1212532C2BF15 9FD343A47D9998AE 21FAE0C83ACD1BE7 19657D9A55E7AFE8 35AD111AA6DCEDED F314139CA360D26B CEE931D4730B6346 3E627386048C5D9B 6653B66810721B82 574B4B9185AE75C4 206ED72E87849C27 B905AB55B07764BD 87E2D2CF89A8E74B 1C0F9D08843D4203 21C2769391CCA26E 161DA565600D3CE4 087BBC95218844D6 26F9DB257A838F3C 5954E86EC7BEC428 6436648492BEFC04 34C05BCDE968A4ED 93DB7ADC1913A379 7066C5ED3F1CE651 3F4F0CC35F6932A6 306FEC69E3CD5318 D3D57047B79E764F 55E2773973098082 DB8B668A2E548BA3 3FF6DE5E77C7974E 3A9BC098541C6D46 EA50FD00EBFD011F 3CAC5462360C5CA6 7467C20C9517EAAD 7F00B9CAFFA94DEF BD18C5D51EFE5666 160CA2E654BC85BF 6E928DC3FEC7813D 472878BEB90D9072
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305221555 (name+title). Key = MD5(password) = 75f78f284f3b3b993a6877d6f3a1e173, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 27b149a2-e5b2-2607-839b-b4c64e72fdef
  2 3dbe263f-152b-28aa-86fa-d8dd8e3fecbe
  3 6b0a8771-6459-346e-b705-680f61cb0d91
  4 6ee9ea25-731d-520e-9098-ac6f954ec596
  5 63dea970-4763-62ed-b341-e33c5f68a9ea
  6 8b3dee67-8279-56dc-acff-5d75976c807e
  7 1cef102d-4d13-16fb-b76c-a7e587ad8cb7
  8 c9f07888-49b0-0435-a89c-619525914fef
  9 7028fbf7-1a1c-8160-81ed-fe9a03700fc9
 10 66cff2a8-2da2-38de-a8f6-c5c8192f0d8d
 11 d408d231-2dd0-297d-83e3-829236bc3447
 12 20148f38-4424-1057-b5ce-8c84257c1be4
 13 7d8029dc-5d0b-7517-adc5-c6558b0c34b9
 14 b9617a1b-8d28-116b-93d6-669f0cde54bb
 15 af1a3692-51e6-8b8a-8277-c35d14192c25
 16 b4afca41-6ff1-3b84-8d80-2f0136412409
 17 ded9db77-7254-52d6-b7f1-4c57a067416e
 18 fe07144f-bfb5-54ed-9ee5-c1a33c0bb905
 19 0008a22a-5f07-805f-adc0-dcf90449ed8a
 20 7a303311-4e3a-4ffa-aecb-4bf8b1eeca7e
 21 9a16445a-95f4-2f77-914c-5f0035d0d11a
 22 bbe33a06-9e83-03af-b5a4-045b480ab71b
 23 7b56cfd4-87f0-1137-a737-e2bee0933877
 24 e28e350f-4618-7cf5-9b80-de7f6cc70366
 25 f44208e6-0b59-8fa0-a3ea-66c4d53f061f
 26 7572acad-25e5-80a8-9a43-a4752e7b2a93
 27 8ed66055-ec02-5a04-9002-4bc5eb4bc8e2
 28 953d0719-47cb-1261-b3ba-4adec91a71c4
 29 e277f36b-f0d1-419f-b2c4-ea4209c95e1a
 30 8e487bd0-fe53-1a3a-b167-9b4214d1559c
 31 3762417c-32f7-4c26-9516-b6c03a2ba7a7
 32 e4d9090a-60af-497c-9ad7-53e39187bf10
 33 a48175a4-dd4e-0a7f-8b56-136502383bf4
 34 8b1d1bb9-23d9-4fd2-8bad-94a8a43c572d
 35 a2234198-830f-2b65-9a68-3f86319adaaf
 36 1c4c2f52-a9e7-2fa8-8577-f72927fb013c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 223565108321718355842017885141440422. Exactly this sequence comes out of new Random(380).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 49 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs