A858DE45F56D9BC9 archive

201305290319 1f7tta

explained decrypted filler

seed 818

Metadata

Post ID
1f7tta
Title
201305290319 → 2013-05-29 03:19 on A858's clock
Posted (UTC)
2013-05-28 19:19:47
Timezone
UTC+8 · title 03:19 against posted 19:19 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201305290319) = 145894c7df649c2dc72ec501874ebc6e (name+title)
GUIDs
36
Filler GUID seed
new Random(818).Next(9) ✓ verified
Run
Run 46 (seed 39,043,781) (seed)
Draw
70 · predicted N = 36 ✓
Machine boot
2013-05-15 03:07–10:31 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
14 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6E4D46FFB7F75C1C 26572DDB5FA72867 BEB04C0B7DCC8E3E E5FB521CA8CB1F8D A02BF80582488FC5 EAD3CB86014817AD 5E97E773351A82B0 4946A46967B52783 5F055D0E47C6369E AD95F51F9EF4B4BE 7250E10276CCEE9C 407803C859DC5C85 82F18DF836AB6E02 07DC4EC1CDF2BAF1 2805A952A0309817 BB28C4E034D6323E 6CF4E414569A61AF FC4122DA91363E9D F97B4F0A455C44FF C4A82C7E1CE8C76E D8719E47330778C2 4834F001968AB359 4BB87CDF4B1D206F 057D74E8A2746F70 AF916483BD0CEEA7 9994935C6689E3E0 35238E858C066AEB FBF5128493720D29 4332557F8F20FCAA B0860D042AC12714 39FE0ABA04B01440 760CDBF7D5868588 355D1D9B608496FC 1E07800D3E44A468 EE9FCBAD570312C6 C3F9B84BC1427C8E 375485088C4E0E4B BA3C97A4944883A8 35726AD97932DE0D 715EEE3BFF426BCB 8F4ACB4CDB18EE56 75C14DAD99B8DBB4 9684136A97233EC9 149C9E39E86EB554 25CB0853AA72B1C9 37728C0CDA148975 7F3A27FA4504BAA6 5CF88A49E8606D78 56B61A4B13266C02 232B890825093449 2630D2ADBB5001D8 BD81DB6CF43138F5 0D4EF4E47DAAA28C 21672D8164C35BDC 070226C1FF3801A6 577649999FC256F1 DDD8C9BBB23F9C6C 2172288BAE008DCB E045646082C65DBC 6C5F3CE555CB0105 17DF127DD50FB077 DE00118B7909C1E5 6114CD6036AF4FAF 401E933498C82E15 819B695828473279 ACB48129A9C37053 1822E101C0B17890 1301225B76FAB914 93F398951AAD5C53 38CAEE761EE458B7 B9C695FF87703DD9 21EECBC7CBE1B8A9 2F36504CDE55A73A CC93CD0BFF07CA2F DEECEE8F9BA15BAB 7503584FF892773E B8D1DD5B73044710 8DB3A57FEC7D76F3 7850B956BD989368 6E69B92F9FBFC410 6062D2FEADA064A7 27E8522DE1F5C7BF 01A769BD37B52136 6CEDB2DBB364E5ED 36A2BBEE0D61484A 6FEB7E209C2B22F8 680DA00EFE5FB932 D3F7FDE5B5C27C3D 8B292FB7F815F1C3 6A5922965055B824 239CD0F794E5C833 7BDEE96F7D3D02AA 20551048F472D0F6 767D04B1BD102941 C3836BF72C9262CE D4C7DFC121466779 7A9224B5C3272D30 C0D699CA036C8E85 B065505CD4B1398C 19D090E0C096AC84 144A33782FDE6333 AF577973B2F3B415 6613E199A64C6729 C1318B5A3FE9BADD DE3BBD32B4DF73BC 01142AC5F31C3302 17574E282BD59549 9DA3448C49080F15 0CAB6841BE0A5979 75C84F98FB87B64C 6C6D94911230300A 5CA19EFC4D1E7F8D E98AC3230FFA9105 F759D67BF0CF0B74 D92F37F37A98E593 38FB7CD8892ED826 D91C89844CD0625C BE48B6E818AC85D6 54CF7C6388664264 F45784315537C3FE D6377F3E1D03E8DC 0111F3E92B957E22 6C3CFE486389CA9B CED300DE37BBBE81 132E99C0E52CACA6 BB9BA4809566FB66 41CBAF8C76DB5954 D388F2F5915AF0E1 68A405B733BDC00B 264502AD842CF2ED 2B705D3D0D3F1DE0 8B3EB0CB55CB1D86 CB2CDC4AACBAB58B 4BBB84AF652447FC 5FA3BCB69C4D937B 4562CB53D41D7410 116E80401B1CFDD6 6B8B6F2900B17C8F B62DFD3D62A331CC 1B58D1DFCA404ABB 34E96C2B2E94A7E3 B832403FD6FB6CA4 15690F1FC3DD2859 7D76603D4347ECCF 0727678D3B50D21E
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201305290319 (name+title). Key = MD5(password) = 145894c7df649c2dc72ec501874ebc6e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cb6d780b-e13b-056c-accb-b75956998a05
  2 c4829906-f25b-7c6e-8d70-4647f4556d83
  3 8f61c453-ff2d-438b-af53-dd9bb54ce3ce
  4 79860667-36c4-1d79-9e02-4d01bd0299d7
  5 4085e4ff-023b-4616-a96d-9b12e1249062
  6 ef210915-78d8-3249-8bae-ee3c00610960
  7 5ed7228c-6170-39bc-8c99-bccadb89e478
  8 153c2fce-c18e-745a-adc8-0a33a3e3613f
  9 333f225a-248b-19a9-9322-cfc36104d23e
 10 07bb8588-9a07-8fdb-b040-37ad4ab0fa15
 11 81ab76cb-6fd7-8096-9846-42bcc1015c64
 12 f24e48d8-0c65-0548-b09d-8ceb829cb454
 13 073cd7f4-aa7f-843c-b47b-f9d371d760b2
 14 d1fdd17e-a4b8-0a7d-b3f0-bde0b87c21ca
 15 6b9e654c-61b8-5183-92d2-c81b5e9c18e1
 16 fa457fc7-edf4-7bb2-8de4-c239c2ae853c
 17 7b93e471-61fe-6159-9148-634ce5dca0a5
 18 7e40d21d-a455-1389-9d64-b5e51290f338
 19 1c16e1c4-1a8c-7d33-b810-0a6be8f27ea9
 20 a8e4d760-2802-0543-8fda-7dea96f69f11
 21 08ba7c7a-6e96-4d27-9126-c0729f4b9ea9
 22 2cc6dd5e-393a-41b3-97e0-398dd0810979
 23 f55a80f7-a76f-294a-9527-d042e4e7de17
 24 1c2b7d69-6570-78c8-93b0-fc109dfaa251
 25 ad9dccd3-fa69-7521-aed0-d01df5234f41
 26 40b3d50f-cf28-5622-94a5-8691eeeddb67
 27 d42a61e7-912c-194b-8d75-67b351556c46
 28 ba23fbfc-55be-4433-b30f-13f5e67ae5dc
 29 66b825ff-6dee-48f1-89ca-adbbe3ea9a34
 30 9f89b86d-ce27-7512-99b8-964ff4a16697
 31 601afb2c-a6f0-1dcc-a7bb-37d700e70fd6
 32 371fe710-0716-817f-aea3-d5c677d9648a
 33 adf05eae-075f-2c00-8807-6ab843a2ee03
 34 bdd226d0-f4ea-4533-a6dc-30cce9b1af06
 35 a0c52ee8-71c8-2c60-9d8e-070256421f7d
 36 67c5edc4-5004-1e44-b175-0b189e8720c0

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 074143371880805761704427751447182421. Exactly this sequence comes out of new Random(818).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 70 of Run 46 (seed 39,043,781): new Random(39043781), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-15 03:07–10:31).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs