A858DE45F56D9BC9 archive

201306231759 1gximh

explained decrypted filler

seed 326

Metadata

Post ID
1gximh
Title
201306231759 → 2013-06-23 17:59 on A858's clock
Posted (UTC)
2013-06-23 21:59:53
Timezone
UTC−4 · title 17:59 against posted 21:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201306231759) = a24c677346dd743267f5c999cc675a15 (name+title)
GUIDs
36
Filler GUID seed
new Random(326).Next(9) ✓ verified
Run
Run 48 (seed 387,048,281) (seed)
Draw
7 · predicted N = 36 ✓
Machine boot
2013-06-12 10:29–10:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
17 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

371EAB070AE8723C 9665070FDFAA53FD 80EA0489BEF8EC1B 33F0177170D74014 CDE30A9BD314CC33 FAE6B05DB7A85B89 C8560ADD9C081E55 C351E216A9135433 8D6D48C61AF9B2B9 FC7CBF422B3549B0 76F3B9E71F6BB28C C8DBF090F37F0857 9A902E66AA7101AC C80815E723E63143 588B5A963BB3968C E5FC914F74995ABB 3140894870C262A7 AF13ADD4796AECEF 7C765819F96A21C4 434BC28A61DCDC7D 28E0F8FCE00CD16F C681B11AC59549DD 378D026D55073291 3758105125FF1B9C B97FC2432CB2419F A265001BFAEEAC96 24B5EF3211629934 4B08014B474CF206 273287CACF171D5E 6E5596C3C82DE97F 7450008A3A875A78 A0878D590598DE49 F27F10D135DA4EF2 958986DD80CD11F0 7C4E2DEB4EEEDE65 9B360F2CCCEAE5E4 5AD201B55BEC0147 5D4A529A89540C09 6296F2E43E3ACFBF BC0CC97DF9443A38 6AC0DA28935619D9 98AAB42D9DDAF23A 0F229FEC5DC29313 450D2B1B647DD32B B3B1F9C13E34109A 60182DA3C75060A0 D664768E98A23581 D1DB9C1F9563F971 66E53E7600324BE4 12B97C37D60E23D3 CC95FDAEACB8BDBE 1E1B140D3FA73FB9 0E28591580134CAE 36AF823859316C16 25D970E512199221 4426FDA366754690 48D3EED9A45E2E1B 07FECA7B3307BB9B E6C8C4577C284389 9CCD368DA15E446D 77928391FF773540 9AA5488947FB3C27 3D61B8B0613D9BFF FDA4157CD2340B76 71F9BAE38728942A ED087A4137C0499E 20850F56B5F821CF 865BE6F3E9EB1079 FA16884DEFD6D3EB F42940A7AF563F9C E8D8BDC9A91846B7 09EC8D0887DE70CD BCE8F2A63EDFCB5C 2F36B8D18B174F59 D699173EF5C57ABE 5EB165973DD80C1B 6914FD7B102A12EE 24F3437A52E96EB3 06871B805C0C4289 9D5148F45EFD856D 5FB73431A4ABBE2B B0F5232FAFAB7853 08CD8997C815E240 1077AE596520295A E1B00D37AFB0B34D 664E5FB704217853 EBBCDB58657BF586 6E47E78021A43EAA 1FBF0ACAD1B177EE 5B94DE6CC9F7F54E 21F9634CF2A756C5 D8F9A265AAB192AF 62ED151E5290A2DD FC257EBA50FBAEE8 7A002FD076017120 6971B9F6C9A33E47 39DC620EDE263FB3 EB946EED7CAB836F A904DEEF9009EBE2 260E53C6C8BDCBEA BF5CC0548653C348 406153949DDD922C 55ED7853B4D33457 3D2A36E5AD315A99 254A848641AF8C53 D42F166F0782FB66 9ACCADBAF9578E2C BD358136C38345BF 40B697BCA4C16A07 6DC10B234EAE5461 B5A4E2B246905D21 3819206A9F3E831B 7D4AA34F12E28745 86B132DAF4C4EEF6 F9F8C8214F363D76 DEF46DA19AB129F6 9EDD2CB26183293F 8E164C4EC0A7CB28 14894875BD2C142E F0FA4D2DF5F29725 E321A8A1099DA7F0 45ABB21A82579DC1 427B2CBB5FB584ED 5C78E0B7975857FF 12FD29514B52B696 AC9D4C7BF960B9FB B976BF950BBBEE05 C38B1B97375E876E 2CF963F7F2374214 11C28EF82EACD824 C3B0EB7A5480ECCB 55BFEB250A3B2F05 099B274923A8A606 13EEF9001D4B2B51 7659947671A0CAF8 AEEEF21426C1594B 6FCEC61B0C5994C7 F87A3889DED1871A 53872769D90786BE 8F60D063B4ECD67B 6C16C700545151F6 60CF679BD42F3DD6 4F02693A814C72EA 2115C68DB1A8387C E061412845092F0F
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201306231759 (name+title). Key = MD5(password) = a24c677346dd743267f5c999cc675a15, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5904dc74-b04d-0c20-97b3-b378399f6055
  2 edff10d7-e9c2-4b90-9aa0-6cae08a8e266
  3 a1177584-1784-5dd1-a6bd-7426b4280484
  4 f490dfe6-19c5-1199-8145-e15e7c299416
  5 37bc7ae1-3d62-3f70-90c5-7d763c1c172e
  6 e127c9de-51c3-415c-9ff3-928d78c91f61
  7 92589b41-45f6-85dd-ab61-46125ed70d6f
  8 a1fb9e83-eb55-8cba-a356-7c065413b34e
  9 1608b074-5bb3-2ae6-a4de-db9d5aa0c3cf
 10 f7bbc4a4-4bed-43ed-abea-4f9a803d4d20
 11 e0b5347e-6f73-4495-a2cb-42879d774040
 12 7822f537-6643-8a05-bcdf-ae5bcaab8472
 13 0cce3f21-62e9-675b-bd48-1724d1c0e5de
 14 a01252bd-adf5-09c9-bdc6-428753d9948b
 15 e9a304e4-6ffe-1a6e-88b1-6d29adcce389
 16 72ab5e4c-0779-5abf-b171-037d295fcfbe
 17 6d3aacd2-6cfc-8869-844d-fd11f7f9bef4
 18 9ce20008-4241-1b08-aad6-1df13faa6c00
 19 d5a2a335-5736-445d-97c6-a792c3d8d9f1
 20 979a743a-ad8c-4726-a7da-f543b2e050fe
 21 1f2e639f-f2b2-1fb9-a522-e386a114492d
 22 6d2ad8f8-28e8-72ed-8881-25d9989a68bd
 23 45473686-1ed7-0e4d-98d8-85be5e6b7807
 24 abb1d524-f9c7-84cb-b9fe-a32ad1afcc39
 25 58371888-a539-5f80-a6f6-5cf2bc8c9c48
 26 5398bdd1-709b-1032-854a-e76fd23a7630
 27 b5b91159-dced-1b6d-a210-23bd2618fe95
 28 9c568c2e-0127-664f-a602-0853846e97d4
 29 e01ec960-9b11-5aa2-91a5-bf2dd1e8ffc5
 30 556aa6da-c17d-5511-bc9d-f82a60dff6e1
 31 7223d24a-ed6f-4d17-9d82-5e563542fe67
 32 32eac162-f228-2455-9c1c-7b5020d74770
 33 f8e95684-7b30-383a-a660-745094f92acb
 34 3663c6cf-029f-1733-b640-16f17e0af0f7
 35 d6081380-46e1-4922-b5eb-e145b6b0d8d1
 36 2d337d73-f89e-87f6-870a-21ec3d4f3ac9

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 045134882448601581441708511655423148. Exactly this sequence comes out of new Random(326).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 7 of Run 48 (seed 387,048,281): new Random(387048281), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-06-12 10:29–10:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs