A858DE45F56D9BC9 archive

201305262331 1f31g9

explained decrypted filler

seed 489

Metadata

Post ID
1f31g9
Title
201305262331 → 2013-05-26 23:31 on A858's clock
Posted (UTC)
2013-05-26 15:31:47
Timezone
UTC+8 · title 23:31 against posted 15:31 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305262331) = 65928134b748a8b26c8c73b88de223c0 (name+title)
GUIDs
36
Filler GUID seed
new Random(489).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
63 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
15 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FBB61D3BF079C63D C9D07D86724A6240 D5CD7EFAEB3DAB60 A416E287A71CAF47 6E2E013BEDAE6548 BFBC313EEE8FF022 CF9195CFF450EDEC 162B63DABA9C4B0E F0C4C0229F7F73E6 097BAC8AF351B828 0017E2F2BF80BD92 5578FB7C9AA830E4 6118BE5A9B74CCB7 DF7DB4FFAD128B48 B44B70913A2BF0BF 58825CBCEBBE8E77 EBFB5F589E8844AA 1A938A405DFB7B18 D375335D7F52B819 8B75DF9307389060 D659792C009FE303 831168FE1FD4B87C 700789D93BEB13DB C4384A7DB3687AFE 62A1DCAAF8EC1A82 1CAD40288500A7F7 03E8DF60DE21F6C5 441867D3A35BE0C3 85D68CE9042EE35C F0ADB38F69E8E083 9307984CC5106865 40C1A26FAE4E0ED9 0F9B704461F69399 B0B96B01FA7DE011 505142EC65641783 07DB6FE69EF90BBF 80DCB15E5587D3E4 9A9B61E01CC63CC6 CD51F40C5F7BAC3F 31354B75B235F84C 4391EF5185EF1024 DE0A2D09C993FF1A 1043AF5E45E91B96 7602B422120634F1 2E15A0144DAEBBDF 1FECDC2077CE23B8 07E3B43DF71D603F 26943BDB5876FC4E C0F017D82DCFCAD9 0571358117A79DBD 1CB3CF4F16B3CAA7 0311D111DA019C0E 527631A95D7F6FB4 B7D899B7CFFA76DC 8A7C6E3D83AA965D E9B3E9809A988029 6385EC0C864EAF90 077F4445549D29EA 51C7D08650BE1BC7 69DC959D05873D04 7046CA7B92DAEB38 D5DADD97DFA165A9 63AB522A2D1C33A0 FF5242802EC9B46E 058F993029067E10 4037EB502583D26F 5F58806353451ABD 3648E6F98C7A9925 617FFF46945EA545 73A5A855B09BCEA8 AD94910EBFC8C283 5F0EBB0069A1E7C5 7F60B67CFAE831A5 2B5D08BFE5311F0C 3C8EFBAA2DBA8B1C 78E569AC2A8228FC 9B3B896422FE26BC 202BB60C3BBC5E79 5FF4FD070CE4AAEA CC708039F1F51321 BB656BD8FEB73C29 F6CF5C4D86C42E7B 9608891FF8C19CB2 1FCC6F41A43F33D6 A306A03C1E51A1E0 A7FB2D860B585E4C B232B00E07A43052 42F5363F763CDDB7 AD92B14695D2E5E2 CADED92DFE64FDEF A9AB2C9FB77FE5B0 D8812A4EC00E061B CCC00F49A7C0EEA5 BAF1F2A2153F155A E28F566E74DC454A 9DCB89F8DACC79C3 7B7AE657AFBF0C69 E7A109B2B5EF21A5 B2247256EC3861EA 97E1BCB05F116721 573E71299A7D564C 0E5F1DB0C0E52FFD 5AEED3E59D8C614C 9AE749B992C693D2 C822653281A4A341 B31C6BD23F57797A 7194CCFB1415BE31 3155A270FC2E7A6E 274790D34B3F6A7B E9C664710E1D5916 A576CC3E62F63B55 08532E6382738D87 DD54091DE97DB8D1 76D1A54219F2B84A 99D1937E57079D87 D19E1E6AB9D3E867 657A59E37773A83E EE51488A8DDA89DD 26BBE41A60832CC2 19E872B5E20DE46D D4F0BD6886CFC8CC 43B803D1EA245283 87D7268469732E10 6357423E05B6AA73 4E3B66529EFF9E06 42221CA8D1AABE20 E044773B3A12F14C 9EBC813DD2C01142 BF8AD855AFBA994A A0250CBBAB159225 2629D71DCC441F3A 59CA507326CA4FA2 2FEF60AC0BA60CE5 3117FBCB636B0B7A 2C918AB3C32D1915 DD7FE6D2C26E2355 A985F31547029E8C 2B268DDC9DE73848 F7F91C95BC1DEB4C A8C5AD4C96E27B80 AA87D2A6DAE7ADDC 34CF593A3CA7F9FC FCC09C5DFF57CEE8 C5A396A1DA6288C2 848DD09E57AB4D9C
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305262331 (name+title). Key = MD5(password) = 65928134b748a8b26c8c73b88de223c0, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 36000985-3b9c-13d4-a01c-6d55f1a799ef
  2 6274ac8f-5c23-2f45-ba91-23e2cad81a4c
  3 b847790c-8f16-5e68-aea7-65127076e8b6
  4 79a059d3-fb83-8871-bd61-20117935eae2
  5 ea8dc5ac-9524-8126-aab4-4690af9e306f
  6 07ae9e0c-5442-8394-a606-c8e5f7458f88
  7 f2ff382a-1121-0f76-afdb-ac4f82495b05
  8 e8e8b337-bf9f-640a-b052-143ae607d266
  9 fa6dae3e-197d-48bb-a2cd-9ce7a5a08fe0
 10 e4826beb-4634-5e1a-8239-fe4e3247ee1c
 11 d1dcc43b-7534-449c-bae3-c1176ca86dcb
 12 34468ca1-5441-21f6-8865-21860c7dd9a1
 13 3f6903ee-ab9c-78a9-8731-303b9eb5426f
 14 ad313be0-ec8d-7a56-a357-1d404690706f
 15 05e01124-9c9c-234b-b66b-3776f75b33cd
 16 be226762-601a-36fc-a4ce-4c61f8a5eeda
 17 9cb86bab-1a44-3dec-9139-284429af26b7
 18 adc00f7d-5c86-19cd-87ec-fe1edb320aa6
 19 05d5ae13-f0fa-8cde-81a5-39ef76acf6c5
 20 99fefd6e-8867-5484-be5e-35bf2f4b4ebc
 21 356c0f27-11c7-7420-acb5-cf25403c091d
 22 fa946a22-2e86-74a7-9e3c-357577e8f8b2
 23 6bf78bcc-46fe-5007-8616-118dfe235fd9
 24 cc9332ff-3870-7287-b22d-aa1c981e0395
 25 0884c73c-6c45-58d2-b80d-aad68d7c8f57
 26 efc4466e-ed9f-0c05-a72c-6b70533963a0
 27 10707db8-0609-3ffb-b329-5646e617d414
 28 4cc7c1df-4f56-69d3-b1fe-c99185c314c0
 29 0c073b84-ef4d-5fb7-b485-16b90d767dcd
 30 ee49674e-a0dd-878b-a2c1-267c9f054e17
 31 8d963a32-d692-6606-9783-5913d97af9f7
 32 acc6dc3e-7122-20b5-b0c0-d2d52cf182bb
 33 644dacb4-08b3-8669-9402-83140fe02400
 34 87bc6de1-1b81-2707-9f46-606d266d9678
 35 dbc8796d-3602-3cf4-abf9-20ea3ae34b03
 36 3f705e8d-dde0-8c92-bdba-d5463ce0900f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 125888064542772331857757503658628238. Exactly this sequence comes out of new Random(489).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 63 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs