A858DE45F56D9BC9 archive

201305222319 1eu6n5

explained decrypted filler

3DES(name+title) ECB, 36 GUIDs, seed 889

Metadata

Post ID
1eu6n5
Title
201305222319 → 2013-05-22 23:19 on A858's clock
Posted (UTC)
2013-05-22 15:19:53
Timezone
UTC+8 · title 23:19 against posted 15:19 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305222319) = a205bf76dc101a15e382dcd46d7c247d (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
36
Filler GUID seed
new Random(889).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
50 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AF129007CDE0BA44 E12DAF76326AD130 8AAB7BACA73B4BFE 2C60C9D3EC66FE43 BEA56CCE205BA4E0 B6F2A742EA10F6D8 2336E6A57ED2C2C3 8285C65EAAEEC3E0 CDFF67E1DC04B067 6C9EC6C3C6307C6A 0A77DEA37EAC4F85 DA9F5E0B9022EF02 B17A210861FABF30 23650874448434C6 9632F0DA722D500F 009A230A2F75F3A4 93C04ECF5161A3E9 B5E42345F437F753 A41C428E61AC3EE6 7AC1ACA2B8858565 25918D40B68C7CD5 F18ED82EF1D6E34A 248C3F0DB3CD0FB6 777B1DE32CD802C5 3CD16D52D0436F2C B67C7ACD8640935D BAA3AD08748EAFF3 DEA49AAF77F58CCE 1444EF4CE5208DBC DB63CF729577DC14 29BFEC7E6405527C 1383B310E89018D7 4CFB1962047EFB5B 333006CB7A9D4034 1664A35B53469945 F62B8000DDD12824 939920EE9240C8A1 10454104D4C31497 0D8A3B55CC40F992 54137CCF35BDB8B5 48A8AA6419699550 16D80C009DA0F9D4 AB6A3F7B8AC3C274 D6E5FDB4D56AD565 C790E9CDEC55FC5D 51662FFABDDA7203 F691E5594F21D737 593CF08051889889 693A09FBEE989F9C B3ACC57A671EFA3C 45EF6227717CDADC 669FCC8010FF636D 8524E783CC81F425 673AB6D2D1DB17BE 3E4F9B61CF09367B 672E40ADBF4951F6 FDBD113B7A62C386 D47B4DA13E5C79F9 48FC931088EE6C4C 41042AD161D55940 5DA484D6364A9564 4AC9A150EB79210D 62BED42ADE357793 3B6433E24BBB2BBF 3C4D095F663D6AF0 E4E7E05B1F4E29C9 512D26BD3CC45D0C 0E8389B09518AF26 A684234D93138DFB FC43189C5AAB6740 DA1DFB24539FEE92 CDD720FEDD6054E1 289C75B647D52523 631A333703C06D16 AF4EAAB22A57074C 514B25894F245D89 E1C18A064B1D5B79 2B1F45FEEB743F75 DA56A31D0CCEF51E 41FB60C7F7416038 5D078D30EE1D0961 8DFA7E29A27C7F2B ECBC4F2B4810B2B2 3B2349743B476E1B 44C916C2A0BE3ABB 6B7A3CFD4BCBD64C DA008D026C774D6E B4DD7EE4C49E77B0 69B168990ECEE583 276B5F14854E46ED CEC05A645CC6CD60 3C624D49121EA15E C564D5D485E1896D B9FA74D1235B3280 7A567B2942F82129 E7C411CFA15D5094 3DA0C8F11A3B1222 337C256EFF3F289A E7513531D776B9D3 B6A0EA954CE27FF7 420D4BFFBDA3A7CF F09026A7946E52E3 9DF958EA5DC12748 84DBC054A8ED42F3 0956123234EA9850 F802787B6D50ED43 86DAAA5995241CB9 4B15C6F71893F60A 4F71332F491E499A 0D6C8FAED5F0E650 E3A7C4B66608118A 4D41530ADB55B0E5 397B299D1F7AD2B4 9DF519957345BD0F 82E9AE2600790F1B C916CDBEF8421196 DA5278B438D39775 58457E3BFA50D4D0 EFC2EB2EE3208CB0 08382A6F8811D3D4 7267E819CD1B3638 763B87702A5D928A 20BE0724591EE059 6812E7B040DB57EA 597CABDFAE7A7EA7 E672193D829A3B7E 74A7AC488A0D6825 1E7EF7E8B30040E4 0DCA0201436D0930 17CDAA78D53673B5 D7C2470D9AEB12A1 CA6104DD5843D1FC A668A4FAFC04C0E5 EC2EF75A0EF19891 5EE0BEE4F97789CB 96386C0F68B93DFF 8454CF807A05A03E F558D012CF6F0F1E 2DA95D8D57146E19 886A695AC2312ABE 2DCD7F3B5F5C927D 2F10EC10EED95F13 DB13E50FC4C13B4D 25EA661D89BB589D F21CC0F9D3B18C86
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305222319 (name+title). Key = MD5(password) = a205bf76dc101a15e382dcd46d7c247d, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cc28c1e1-c4bb-1414-b009-6f279afcddc6
  2 e7b864af-8287-5162-a52d-823002428ec7
  3 7fd430da-813c-115a-9c28-8a2276a701ff
  4 be69d00d-65a2-2afe-906b-69bb7f70a9c2
  5 46025cea-43ff-54d4-abc2-ac5542398752
  6 21370dd5-4063-4c54-bee9-378513ee1fdc
  7 0c5854bc-2a6e-2aca-9338-a1433ff038af
  8 bd8eb396-9466-3884-bae9-0e65bea53dda
  9 5771abc1-9b60-89da-820b-72101f3fd520
 10 fa4fc0da-5043-0c48-902b-798bdee5fde0
 11 fa232b82-27f5-2dff-8b4a-912a59a8e35b
 12 120ab7c1-1a04-45a5-9c00-53211e601b83
 13 21e05e5a-5a32-6021-8784-6215376c8843
 14 371526c3-73a1-8be7-9581-0394c88367b4
 15 ddab9cbd-c381-2772-b875-a2ad5aeb36e9
 16 ed369460-9abd-2f65-bdbb-a41570af9a3f
 17 7d129fd3-2520-5415-9ce0-f57c5303b1ea
 18 a3d2f02b-84f3-1940-96fa-1bc28a201dcc
 19 8397ba8d-8d95-6ec5-881b-075e01eae1f6
 20 f91c9a39-42dd-4f96-96b3-2a8c7e526d95
 21 61514505-5911-86f8-90c9-5e835d4e5555
 22 8c42bcb3-c526-8fb3-b144-61f45d130f5a
 23 8d3ec3dc-63a8-225f-9a6f-93d5a56d40cf
 24 c419e6d4-c371-541a-9179-2b4b3a36b245
 25 dc2cf5d3-c0c1-7845-bf81-07c3c217dd96
 26 ed689952-b978-2291-b7ab-ff77ca60decd
 27 99b67339-308b-2c03-9d1c-8c7e1dc12b0e
 28 6223ec06-9fe7-43f2-9bf0-443f6999e20f
 29 434f6fab-1afb-092b-9905-24b766c90551
 30 32e076d0-8f78-0c4f-b44e-924e3b8dba8e
 31 02c7708f-c5c2-3fea-a678-6f0b993d89cc
 32 2c4d4e70-dd44-5b0a-b466-e7db5563ecef
 33 2cd749c6-4e07-731b-9a97-7fb4ad20338c
 34 9d25591a-1a3a-2427-b4bc-3e2d55010192
 35 3cf5bef4-0a78-0dc1-915b-b8eb05c4f5e2
 36 e39889d4-04be-2dfe-81dc-d1950daaa454

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 151254238024682251648825722400357202. Exactly this sequence comes out of new Random(889).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 50 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results