A858DE45F56D9BC9 archive

201305260119 1f1ckp

explained decrypted filler

seed 688

Metadata

Post ID
1f1ckp
Title
201305260119 → 2013-05-26 01:19 on A858's clock
Posted (UTC)
2013-05-25 17:19:49
Timezone
UTC+8 · title 01:19 against posted 17:19 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305260119) = 7e80b67c3843361135ca5e56f78e320d (name+title)
GUIDs
36
Filler GUID seed
new Random(688).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
60 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

99BE20330B2E8FD4 AE1DD1433D5758C3 2452B9C33850B7D3 AA11129219901C84 C5C889E3B4D33C49 7B4AF84B55A43580 DD7955519540CEA5 67CDCBFE5C1E6E2E 86804CC74CAA3B32 25E3531EA7148DB7 678F48A015A04EB6 70E539008D5CB65B 10D4414F1DC7BD48 013BB1E644B6442A F4FAD03D004AB228 3900B823280DDBE2 723994EA08CFFC44 00FE0EC57522B486 75B025DDCD2B13A8 98621143D0DE6606 96E47910071B473C 586665FAE4AF4AF3 EFE49E8880F4D146 4B16A132481733AB 6EF0DA1F1770855D 02D46DF7A387583E C5290CD48D3E84A8 E3DD812A9AA0C580 54B0705600F3C5C9 7B28BE1DCED88F17 308BB4E3A6DFDE19 DF2BEF7482A785B7 891FD16FE739FA61 C4AF393157807600 8BBD279D95364D77 F999493A869C553C A4FAB75EC079F68A A8840EFE7DDD92EF A733D3EF9CEB63F1 9BD92D93CEDB6DAC 927BB8DD9BEC7988 31EADF121D8A021F BB3C00D5DCC8B0C4 C626A35C9879E17B 4A5AA4629B46A7E1 FBA975D67928716E 45B1C053E2A7A4E7 21D8EDE25F9DCCE3 B9E374ACF53B7A0C 5741224717C294A8 58C3CCEFEE231C99 09F3148C03169BEE CB2117A175350047 A22E28FB5AA8689A C42D8F059DF76219 55EB079479991FF3 6E7D2E99E7E4BBB6 ED9A291255076AA8 FD7228A839C7724B 6FFE7C1552FC40E7 D52666033F1AEF1B E3E51F8D13CAB5E4 61B137EC7E73E5A3 B88C556CAECA2F39 CD73B0AF234F2BDE 4FFAE1EFDDA0C7A1 9DEADAF1139843BF 69AD8E9B701E4F8F 7981D0C28DD3FDDA B0114B2CD10F411A 9BC853E0A446DDDE A06582276E57AC23 0A8EAADD275AD55E 3E45D52936140202 321F4CA7D0165EA0 C177178617471683 99E93C855BCEDC69 E2B5386BC81C0334 D03C9604FFDA4277 9D48150103F32DC1 C37B295F6DB54E68 ED65807B9E752050 553538C5B2CA20BD F01269F8123988CC DE03CCE5DFFF4C0F 1DF874088596A027 C51C081294371371 AD84AAD33A8FF8E1 2B32219423EF947D 21FC4A38113DA1C3 2BC9245FB3A06BCD 729FD330A71ACB34 8D645C7EE7480421 B79D42C96ABD7712 8584F973C90D8F89 28926748460A0152 2CAD6BB648C35F65 7F846A7E438E4072 7434D17AEAADF653 87D93AF895106588 13388C9B55254122 F319FDBAB971974F 582DE85DA0CB66F9 CBA473D9407E02B9 924770AEC8504A13 607832C86BAEF53C CA3A9CF3A2308654 95457F44EE1CC95C 3DBAB69E7E5C697C 84C13331C137334F 264A3E20C2823F81 505BFD3535886F72 8288663140825A05 E1E170C8296DECD7 E58BA3C3B82E3606 1D90850A855123B8 27C37F56EA4E289D 65E4D385EE5DB426 76078EA3D50F3F89 8D4A603576FEA250 F136CDDB145FC740 725C27D2450DBF4E 26701AA4FC5886D9 DCE415A4320F33C0 6BEE8A1D92881827 7941B9D27C667A83 06C1E0C0D8C43379 977106690DBD5856 6F243AD77D7E0EFF 6E17494BFB3DDE40 94C9F8DEC9206C73 9B65A9E139AED51C 1FAD31980AFE3F76 239B8A65713D57C2 C806CB3612062667 2DA7DF0A053E4F8A 5FB4E246D3AEB869 0BF98F8D7F9AC02C 92E4FA5F92C105A6 1711522EBFB61D61 AEA2A687A20FE490 EAEBD0A14B29E22F E65EBC78B069AA9B E477685865308234 DC40970205E86559
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305260119 (name+title). Key = MD5(password) = 7e80b67c3843361135ca5e56f78e320d, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5767d8eb-534d-15e2-9387-00a76e0f8f25
  2 15dbe8b0-9bec-6796-beb9-428f3b3966e2
  3 9c46ff45-12c6-6f09-8a2d-de65d78a693b
  4 60b1a322-a134-35d1-819b-29da2f5d24e5
  5 f34efd1f-dd20-7bdd-8817-83205b84c635
  6 241c15a7-2b03-7643-afe7-3cb3c685b06f
  7 748d3033-801d-1a2d-a95a-27bd50bcd449
  8 77c982d5-2154-5cea-ad37-088d9edac1f2
  9 3500cb19-09b3-026a-a3d4-8f1419e00702
 10 44911a0b-f3c6-82df-9bfb-b7d35529642c
 11 650d0258-8399-19d7-922e-b5850a3e39a9
 12 0a3c5167-2a90-5416-9d32-8551c9cde8ad
 13 2340c3a1-b5a3-5010-a3cf-5f05a6f47712
 14 081f51e4-7b05-30ca-8176-3b730e51ff61
 15 3d858a83-6745-599c-b8f7-507bd61f0af2
 16 1388e035-8616-61e7-90d2-a5f7e427f4c4
 17 fcf856a6-e293-0df7-b9cc-5669c06617e5
 18 5d38f34b-1b10-4bde-a450-b8fb05210905
 19 2a2f7aa6-718d-211b-b1eb-3743156c2cdc
 20 28cc137a-dcc6-673a-806b-afd5222f7569
 21 fddfe9c8-89d7-2714-9719-f102d2fda551
 22 39ca4828-450e-5312-9fc7-b599089b0fb0
 23 788c3df5-5ff0-2dbd-b898-ed84aed982f6
 24 b79e7867-1060-317d-b32b-4ed309b3e79f
 25 d8428c83-5788-176e-9213-ac50bc042983
 26 91c765ae-d9ad-0e50-bd4d-70765d548968
 27 abf5b853-5ab4-4e3a-8fdd-34c545d0dd1e
 28 88616e71-fe4e-8a23-b433-bfd82a80d555
 29 82f120fc-8fa7-5b5d-9387-200c16c2d94b
 30 9530f678-1a96-16c8-a727-b257e795bbdf
 31 bac9f06e-ad32-1248-a62a-754460c5e3a1
 32 e140505a-72cf-6085-a7fb-949e5a574a9f
 33 d3489389-6147-861a-bfa3-20dfccf367d3
 34 28559dc2-0078-2a26-95f9-3db5510787c6
 35 e28467c1-6f7c-7fd0-b796-27070b988197
 36 87e47ec2-1d0f-5efe-9f1f-fb87e4d7673b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 166377150815535604262523104851168275. Exactly this sequence comes out of new Random(688).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 60 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs