A858DE45F56D9BC9 archive

201305241219 1eyav7

explained decrypted filler

seed 806

Metadata

Post ID
1eyav7
Title
201305241219 → 2013-05-24 12:19 on A858's clock
Posted (UTC)
2013-05-24 04:19:53
Timezone
UTC+8 · title 12:19 against posted 04:19 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305241219) = 218f499454dccd63e501e34686294d3a (name+title)
GUIDs
36
Filler GUID seed
new Random(806).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
55 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

45A167259D78DAB5 8F9C99BBDAC2EBB8 E049DF1C32757D67 BD970CF8D5F9BB0B 7EC09E34ED346F7A 606A67D8128CC196 CA16BE06F36E5CBD 0C29AFB51555304C C4DA2ACB6B6B3658 8FE2FA1D655693A6 8C2821596F182EC4 FC31C6C9DD7D426A E7A5B0E49666BB0A 44B026E00B98530C FECE3B79E8BD7E5F 2AD04FC026B10642 02F70AA9296A0F0B 64CA71724FD39B0C D54711D09C1CDF51 D01952C04762AC78 1AEE1BFD5B7AC3DF CC866F30CD88EA10 BC3EECC90AF0F319 C164EA53236BAE8B 2EBA2BE241762F82 4F0AD21D50C89BD1 161231E2A87CA3F9 E4D897F134C6D25D 7B2181151C4F07CE 32D48ADBD37B3449 83EFB1D5284BB38D 96F5166F6684DFC4 E9330CD3214F3A98 DC1050CEB750A202 17BA0296A64D227F 010FA4DBCCA02418 65266407AE413151 BCBD8E24A70D59DC 1902BD425DB1184A 6FE454A5727134BD 57FB19B016A8EF70 EBC40A981A9E8E11 07165A42C48018D7 FB9982F472320C4B 710AACD6DC115204 1172E1564100B65C EE07232D8215E9A2 13C06A2D7658F545 CF2BE66933199B9B 14A4CC29B9C6C8CC 82046A92D24A6297 672E2A5E883B6E98 594D545E6A7B2C70 C068CD2C4FB21DA1 280D7785F1A10037 4AEE391F19F62B34 3B17AA8575FC967F 32EB0878BAC2E01C 3092D82C80878905 337E4FB5F360914F 053B90A84F43A78B DDA9C1DCA49C34E7 9B6B8D7C1D694BA7 6790A2C3B1CFC1BC 030DCB91BFCEFEFB 8F62BDF81185943C 74D67DDFE0917422 62B181695EE09B13 E133F4619EB2AC1B 619CAEF8BDEE7D61 D8EE0755B405AC6D B06117F9E1A21EFE E80645905FF2A6C1 18D93ACAB6457B73 0E07259F9269A6E6 DEFE0A4A7EA2A9F6 6B1E675D318A2984 2C8DCA065A066BAD D2F0EBE88789331C 096E399BEE3282B8 69F6C742CF4CB0A8 AB2197D85ACB9B37 2061D93E7BD6A4C9 525729C820C72945 9E9AEC6673516D01 0F51AFAEE1F73F3A 03FCADB631681D11 1879B791F319BF68 06965942DC223CAE 3AA37177FA4500C5 68C0FC231133817D A245D1AB59C3903A 3607B63B4A42D294 A29318A17747C3DD 446BCDAA606EF10E E42A32749B65CD1C 045D418FB6C3355E 5F5C60AAB233339E F9CBE57DB6DF5AA8 101BD60DABD813CE 230B0CAFEEB54B60 CAE41B00AB054B47 5FA2E87AE9C347F8 394654BEECE89758 C2E59E34ECF88A6A C1444BB753EB7AEA 42CB7A8568A397A9 6BFB6E289B8FC988 0861C57EF8819946 953AE30658BCD413 136D3A0D9D42B361 10BB2B50BF452799 88B7CE99EA6E9F72 39FB9E9C9440CDAD BDE8C07EA5B52A39 5A108B4B83CA4A64 C7AE722DCFA8DE57 9F58AE222784234B 9344459040CD27E8 1EE9C97AC48DF841 61E02CE0467C7378 0E1EF36C968E3402 76CE5D1BCAF4EE60 E9DC0A47792D406B 6A23F23E75B826C0 F2DC8BD114276627 B85E689F17529573 28D6CE18CF5F2073 6DA5A3FE9E24E5F1 C6E4A59DDB9B3904 33EC18044E1D8816 F30486020589E95F B9DD3FD69B2D510F E6D520498240ACC8 EDF4A5FD61FF3E7A 255A6DC8A7B2F0AA 1D57212B7299D16A 4C798437AAA62D18 CAC637A8EE535D5B DD8FFDCB587467D5 C6937F9950CA7382 8E15EA5701714AB9 E41F292EA941543C 7E5DB6A5F14BCE0F 3BFBD84FC442581B
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305241219 (name+title). Key = MD5(password) = 218f499454dccd63e501e34686294d3a, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ee29700f-9541-7ecd-855f-bb3732b4e72e
  2 5787fdf6-95f0-273b-875a-3408046414d9
  3 6ee6bea3-8344-1b5e-819d-deb278cdde9a
  4 114aaa0b-2203-557f-98f6-7eb69b02775d
  5 4d97bc2b-eff6-0a14-b560-bec700721234
  6 9a4587fb-5842-8a9b-b7cf-15b577113c01
  7 28f91c2d-89ea-0bcf-b65d-4511bb66f6a6
  8 49387c13-a3f4-787a-834a-7b51eea5647c
  9 cf7c915d-0944-68ec-b969-f75817164760
 10 f18575cb-89ef-495b-8113-e387e9270ee4
 11 01db5616-6b27-0455-b99c-e14c41baa592
 12 201b8e48-c233-6a1e-9da2-a9d5139308bd
 13 4744b11b-9de0-60bd-9577-67ae527d836a
 14 9f12c146-0ef3-7d4a-b413-4137bab514b7
 15 11b52d61-2d20-1343-a08c-4580ac162e5f
 16 55424bf1-4e03-32cd-9200-fe9cb6aee295
 17 bf4242fa-0968-60bb-a3d7-49a3b273b417
 18 e5ab0b0b-eaed-6256-ae97-9c637d65c4c3
 19 5a217fef-16c4-49f7-972e-06e75f3af6bd
 20 8cd1de71-de1c-3474-af6a-0a8f0257f3b1
 21 1e6efc71-50b3-8376-873f-c261df94d034
 22 9669bcd1-bdb9-5fc9-b501-f7fd4e8c3d63
 23 3535d805-25b6-1f19-996b-bd340a2dc8fb
 24 674872f4-8b80-51a3-90ee-3a8778041241
 25 bccece15-7ea1-6b41-b3d6-bbc20dc7f93e
 26 92afb04b-4005-85f8-9899-330d6f50fe6d
 27 a4032758-815f-8694-813a-443e4e54fe75
 28 57c01258-dc91-0d37-852a-0693396d40c7
 29 5c7910f7-9475-1656-b6f2-9244c0b59134
 30 e07c1e33-73db-1aa9-a265-18645d732795
 31 a7ec1089-4da6-6051-a54b-9c97e5835deb
 32 87d1992b-93ac-6906-b643-133a9fed9827
 33 82f4d6b5-3dcc-35b0-95f8-10c2a2204ec9
 34 0521e261-f8bf-1503-8b2c-05736f0ea914
 35 00b60150-425a-0f3d-a257-6b8923d24ab0
 36 ac49aac9-213d-6d4e-a0c8-b28939d12528

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 721508076406671366438515688011663106. Exactly this sequence comes out of new Random(806).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 55 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs