A858DE45F56D9BC9 archive

201307061759 1hrqcs

explained decrypted filler

seed 635

Metadata

Post ID
1hrqcs
Title
201307061759 → 2013-07-06 17:59 on A858's clock
Posted (UTC)
2013-07-06 21:59:39
Timezone
UTC−4 · title 17:59 against posted 21:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201307061759) = 8ddc35220685438019e07dc7e363b77e (name+title)
GUIDs
36
Filler GUID seed
new Random(635).Next(9) ✓ verified
Run
Run 48 (seed 387,048,281) (seed)
Draw
20 · predicted N = 36 ✓
Machine boot
2013-06-12 10:29–10:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

EBF2C9997FDD93CE 418907A0888427C1 C8E941E86B4BFE1A E564807B9A3240BA AB46451C5990E947 E06CB7B8470B775A 8FD870D9DF919EDF 41BD32F0B95E563B C3827148C328401F B61DB5DFF3AD9385 7BA09B4FA5ED6A2C 2454839144541E58 5C7F70A1462F1870 7E718DD2D33FC5BB 487DCCE2B6FC0C9D 47C651432A5BEEC6 ABA4B315513AF3C7 3466D20ADF421C69 CE9A3A22CD6239AA 2A22894CE03C9F7E D7315DE66B56CC3B 1E6E3CD05196B7B0 60A3E8F1DD16BCDD BA8F16B0DD8D7231 2A2E53B0FECC3ACF BF35322A0317D0E2 742029231CF6D59D BF5B4A211BB9A73D 8CB72863B0BAEDD3 49FE8C05505D2DF5 410B86A6491CB4E6 C5C9BF6DC79A5164 7CA0DE55F5295ADD 8D93605DFCE3B2A4 18201FA09FD6AE13 685EC61E5253F0D9 077227E8622D63CD 5267186390A9D5A0 DE4015E544F2E14E 9B83D64DABC69F53 054B69483FB3A06F 103AC5636A8D11A2 23053EF526FF5D27 BCA8F6E68E1B3C11 D058BD9ABA29D498 57E39CCF626977B8 803CB87154B07139 C8002CAC467D7DF6 226F1DFC94171B9A 89A19CC5321BCBDB 4F1857FA75DEE7CB 96C8751F67A211F5 633E7BAE21A37548 32B78F24988DDD36 5FBAF813BDF1896F 42908A5E82E6255B 65DDA3EBF5172DDD 336E7AC0DB374BC9 8D57CB9523084823 AA91EE742025AB06 CC606B17963101C4 3C99CE2CBA614F26 6C62E63AD2F543BB A8B9390D214848F9 F133E525BCDB9F5B 0CF99CCB527D8691 9CA9919AB14B2B4D 8B1E9AF45773B85C 41229BCEDA1507DB 1DEEAF3CFCEA5E50 AF053F72AC9839FA AC8C7BDAB1C4505A BE619A7EB5B30BF5 59530C6253457933 9120BB1D9E88BDA5 402E35541C7854A5 AA784F59FC260571 5A0A0DE3C544FBD2 A2A29243A99DB92A 7A64F924427B1422 5EA31AD545AB834B A4DA49D6077D5446 7D3AE109CF941E20 4FB595DE43AA4910 B8698A17B7C83CEE 1F92E4A3D91F5780 8F0A5AB08E9ED13C A125B9E761B699A8 732B3A3E34398345 A13B854AD3D3F0C0 AA42F8600A889CAB A8ED561942852648 B0E69BAA402F8A96 C55DCAEBF61A8E05 677FE92CA077DFA6 8D322B8FF5861888 40F673D786DE72AC 0A51D73CB2E3BA04 857C5239CB2409A5 DC8C83DFAAE87390 861B6C866D4147C8 6ECA0F81E1082F3F 8D6FCC811A80DE29 C41742250339A1CF 4B3AF64C2A0A20E4 0D11FE0D76ECC254 04F23D664300242B 798037D08DD19FF8 F61ED5C9AEA7FB1D E334EF1D22BDC664 08CE09B2EC8E6A25 F2C4F006B67479E6 7C690F9016EC5D52 CAB69179BB1A01B0 24B3179EFC706AD9 36FB687C25C5A14C 0AE292B90565F9FC D8DA98E2D80225CB 9EF41910C1AF24DA F2ED58212810F496 E217167E4694A98A CCC6DD61FC3B01E0 D95C2AD6FCDE2797 4DAED532E1E1F58F 9F5660001B673AE2 0702D7BE66E193A9 F128793B28DAFBB1 57870B75BB2D2C2F E078ECDFBD80CDB1 985480301AC0CA87 EAB8408ED56AF679 E12A9802AEA8E7E4 37D1D4D668BF2E35 38E9B13571AF8D3F 142966675801A880 732DCD9782C22834 A7D306798F4764A4 1EEF149CB825F0D9 9BF5B4926FEED988 77265921027139D7 1BF42A5629E2039A 887C5607C76B68EB 32A645405FDC74E2 1C1CC6406182AE58 9B5B30B8B2D544C0
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201307061759 (name+title). Key = MD5(password) = 8ddc35220685438019e07dc7e363b77e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 604acbf0-eb49-4f70-8f87-18cbd8d4da22
  2 caa70d7c-cdd3-10bb-ade2-f477a5bff099
  3 ebf3ecf6-1bbf-530d-acd6-706a39cda498
  4 5368b5fb-637e-0420-a4e1-f3c3dc76aa18
  5 805d7426-3fa5-8c84-832a-9343bfaf1c49
  6 c1576628-098a-4ca7-8a89-d26f1dc9096e
  7 6013c731-fc00-3aa4-b68e-9462a3b623b4
  8 682e5c31-95fc-0518-aa34-05b52cf45cea
  9 fa27c59f-e6ed-420a-914b-98886e62bfbb
 10 ed8810f1-b998-3345-9f4b-961b7f9fe1b1
 11 8c547f1f-1665-12a7-bcb2-a68774216221
 12 68438553-5013-118b-9979-3070f0e04a62
 13 3e255acc-4ae7-1286-b0e4-538937aa5fae
 14 fa73929f-aae3-7c11-8eab-2d6207d6f91a
 15 191d317d-c523-4bce-99e6-750c9b48ac15
 16 2d9881c4-d62e-52b6-8c70-3ea63b7bba36
 17 e9b04464-f096-7b2c-8791-a58ebfd0c54f
 18 7a3df1ce-52c0-658c-a4b4-30733ca4045a
 19 ed20b38f-8fa4-7890-bd99-19a332330138
 20 03d91ada-3718-1582-b07f-843949a4eea5
 21 64181cac-e467-1808-80c7-5edf1bae3748
 22 039b15f4-4a8a-5e61-90c5-d4b5ff0a3758
 23 29293a63-7321-28c5-a586-aaa7f35272df
 24 982c3d80-7467-733d-aa6e-3af03b0bf2ae
 25 0c774c8e-cc69-8b4a-acab-557d30214292
 26 4bc278b5-4c5c-8c38-8191-bea826d81792
 27 6ebb3172-49a3-7856-860a-287acf3e75e7
 28 3bb46ac9-42c5-1b24-aee7-401d28768cbb
 29 fcf29153-f427-88b5-854f-fd5bc3cbf7b4
 30 aec90102-a7f6-411e-a9e3-4d149f5d78ff
 31 73d79c06-d9fa-58d9-b5f4-e64096fdf91c
 32 e6688883-f123-6049-a819-09df647c2876
 33 6135e0b7-7cf4-5729-a1df-288c85a97b15
 34 7960ed1f-0950-8f37-987a-212b9eed8deb
 35 c535650b-fffd-3ea1-b236-85e099a9cf21
 36 1925abf1-fac2-21b8-b182-80fa00741dce

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 415084304311174576711527887184565832. Exactly this sequence comes out of new Random(635).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 20 of Run 48 (seed 387,048,281): new Random(387048281), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-06-12 10:29–10:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs