A858DE45F56D9BC9 archive

201306092059 1g0jqm

explained decrypted filler

seed 956

Metadata

Post ID
1g0jqm
Title
201306092059 → 2013-06-09 20:59 on A858's clock
Posted (UTC)
2013-06-10 00:59:54
Timezone
UTC−4 · title 20:59 against posted 00:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201306092059) = 4c4da7f700f1a835b8626df13798f687 (name+title)
GUIDs
36
Filler GUID seed
new Random(956).Next(9) ✓ verified
Run
Run 47 (seed 1,776,839,421) (seed)
Draw
11 · predicted N = 36 ✓
Machine boot
2013-05-14 23:26–11:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

84F47DA5538D038C 070440C2B8DC8A2F 04D28DD5655D9CD7 28338900642F5864 F48874EA7E18CD36 B1A444881C54F55C FA72ED2005F057D2 7B64B3D68F27634A 87EFB298F4E6865C AB0E3B82A914B6E9 F1D6FB046D7ECEFA 51FFE2069DF434DE 412F55FB085B1C6F 8D5CD0F6D06BD5EC 8630ACEF0F028181 3CCFF55513C5C885 67BF1F0E1DDD4D62 83454ED2B66C4D6A 55055CFBE2046EEB CCD0423B3F342355 9527DF93E566D566 72A38E4DCBD386DA EC2FB05EFC3441BA 149457F925ED3A1B 57D7F2E14726021F F8AC3A98A056C05E FC557D6F85E16347 E017F7A3609B168B 2975AA5820BC1CDA A095D88272F09D7C 95DA77C674EFA84C 8151D79F22EC6FB3 CA14072AA83A426E 5534D59716560C5D AACB4A0E91A2E2EE 444BEE566AB2ABE3 DD2071BC2E1BBC0A F7874FC1382A067C 7BDE69E80253E053 562120D602F853C6 E4954FFA683DF7A0 AC8F18A582947286 6C268D14FAE62073 88EDC334C41A777A AB93199109EDA994 6A9E11CA5C9CC39B FD6ABBB7E3E879A7 7A76C97337C301D7 155D52350B9770EC 633EED10A42A9B66 0AAF1765ABAF0FA5 EEF437F2D6142980 F5C0B88AE9D08535 D3AAA22D341B69A7 DFD4B16CCA1711A6 7419CE4A6457FCBA 51E3A89CB6578297 FD8D77B6F92549F5 6039D1B890B7FC08 3FDB04C2DD863B4D 42AF1DE2C8CF7020 78B241871D9FD5AA 03F88A46691F5F36 F6B19EBB00CF18C2 E2EDE0F14C48F4C2 2C529DCA47EDD92C 46C022131A60C698 43D72086F7A9CD82 4B301442933D7DAF 61AFECB5D383EAB3 D86AE77964B0C6A0 A6F35F296228FC78 F737AF2C932CA380 AB60D5DAE4879321 F99D5E7C97FD3558 87817C1FA3E5C7E4 F5A1DD82B852AFA7 F517D91722E7254D D0415CCA77F0746D BCF4479F4729D732 78C09BCF6BC5BD6F 10E30CEEAAF982CB 04ECE9AD527F36BA 2CCC90D51069231D 2EB5CACE8EEDC0F5 F2A44283E216C2B1 5CD38D67775DF7EC F2776864C5D92DE0 88770264E5CF228E 4009A5975CE904AE C318382138D6CCBF 87C3E2A0CF4F3659 2EC8FF1517EC974C 544A72F913B0B6FE D044CE122536132B 4B6D1A077F225DAE F12B3D8D3037B291 35313260C0ECEE9C 99A35A6394232A26 F9001871AEA863FA 9725764EF80614CD 8D891D4179F82919 366D50FC0EEB1E4A 54C3024261C43767 51EB64EC7762A86C ADF3319F67F47A20 9F1ADCC6C09260B4 9DE8240EBDEDD343 C91F7E661DC7709B 96CF0E03D38BE9C1 C26E840D02E7D74D 414A9BBED031865B 22B3E3E5AA9DA8FF 56BA16B876F4EC5F 3377D7BF5F582D13 9F8A1AC4D8AF899D 524A45F80D0813C8 3029F8FB966A8AE9 81D339B81C6ECE38 E3F1F0E57057BB1A E2C82975F85C2B8B 850606F508BCF342 408ADB3910994C58 7D59EA0BFD9BCB2C 54AF29C379C4AABF D574DE22EAA74ED5 6316B9A18E47BF02 1B04129C39388361 02057985D94D1A60 302A68672A661D43 11E9F1E4468E22E7 2BA7D8C28BC7A6EE 23FE3EB312F4E3A0 F7F152D1EBB2703F 8850F13847EF35A2 A5851DC20AFEDBB5 2E17F4EF6271C8C4 821364268C749960 FC86C62E537715ED E9B2172137A7E5F7 0C4EEA02ECD50092 57F86963966E565D 5B62DDD011262643 F23F1767C361085A 92B00D559ED7B616
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201306092059 (name+title). Key = MD5(password) = 4c4da7f700f1a835b8626df13798f687, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f3e02fb4-952a-102e-ab5a-df3a753a12b8
  2 e007b491-028c-219c-a5e8-04c8ecc12e5c
  3 e4d6b6db-a7e8-03c9-afe8-4422c31a5eae
  4 1e5413cf-843c-5c28-ade4-ed472faa927a
  5 92f8fec6-509e-7249-b169-d7696dd47e52
  6 9df463ae-15eb-0c14-84e9-722a97a22427
  7 6805b1a5-2b00-2b79-be12-73b49ed4f659
  8 32976e22-f322-0ead-bdf2-288568f276d0
  9 fd3ed83e-27b8-2d68-8b79-bdcad399c164
 10 f99c4afc-a6d8-7efb-9c6e-5fe774aecc28
 11 4f977be0-8073-58c2-bdf1-8665ee855c0a
 12 6ce3fff2-6bd0-7b6e-aea7-89eebfcdb9e5
 13 46bb3abf-a909-74b5-8572-3b0a43b5894e
 14 ebb453f0-b3a0-750b-bd73-d354f2c532e7
 15 cf4aa4a5-3597-1864-88e0-813f2772308d
 16 f8beaf28-13de-0791-8167-43dae1929358
 17 7ea2868b-ce9f-6b6d-a78a-0a26c515b9a9
 18 a287b3d6-e3e5-6ed4-b652-ebb5bfc9c3e4
 19 be156b9f-90cd-5bde-9e65-f851e7edff96
 20 b1933634-3c84-4840-9b75-44938f6c1b31
 21 c372d53c-44f2-73b0-a02c-86d221bbc866
 22 e47a18f3-7dd4-31d4-8d89-92cfc3c363ba
 23 fdb3ed68-09ae-5455-bd0c-55a7ebe1c524
 24 1e1a1aaf-a370-0a17-818d-df0aad17e24d
 25 23f0f81c-218a-3334-80a8-1b094abad929
 26 2753ef29-e547-3a54-a90d-4f1a1bcc64aa
 27 9f7c7781-b393-722a-967d-3a17f986bc98
 28 fe08ad62-f0bb-04b5-aec1-34ca4475b4b3
 29 12d30ea4-6120-54b0-81ca-4fce86cfa532
 30 3d3980a5-ab23-0164-91ae-eb5771ae229a
 31 7eb5b9cc-82dd-1133-8d0e-a4c2dd038256
 32 25db9944-fc57-22af-a1d8-4ca09c7dceb9
 33 d568e72f-8a6b-6579-957d-9d3054294291
 34 b066371b-86a9-8db3-b3e5-a43d438b6cf0
 35 ef02c246-5d61-49cb-b642-b8ad1346c348
 36 1fd55174-361a-1b19-a723-e588d759ed0d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 120570202757771066547350337050126841. Exactly this sequence comes out of new Random(956).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 11 of Run 47 (seed 1,776,839,421): new Random(1776839421), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-05-14 23:26–11:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs