A858DE45F56D9BC9 archive

201307210905 1iq1mf

explained decrypted filler

seed 717

Metadata

Post ID
1iq1mf
Title
201307210905 → 2013-07-21 09:05 on A858's clock
Posted (UTC)
2013-07-21 00:06:00
Timezone
UTC+9 · title 09:05 against posted 00:06 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201307210905) = 04c2bd34efe06ff165998fd97382357b (name+title)
GUIDs
36
Filler GUID seed
new Random(717).Next(9) ✓ verified
Run
Run 49 (seed 822,652,546) (seed)
Draw
33 · predicted N = 36 ✓
Machine boot
2013-07-10 11:27–11:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E6C2C2884282A78C D9619356B4E5E822 674CF9511F169C71 8FD89826F2458C5F 3CC28BC3A771E637 BA957B5A90DE809B 522A2E26AF3AB270 861B5417D0BDA45F AFD2A40236D32353 9AD1255DB15198C9 4AD7BF37650BE826 FD6261D3B7FB950B AA70522266EDAE25 5D1BA1532C29F36F 64A9AC6A8ED08866 301C9D67279DEC53 34E75C897B7F6554 F20C81C8FAD6A818 D258D8B6205F7ED5 0A449FC5BCD1D862 17EB6B18B0570D69 EABBC5FEED140DD0 0CC9CB704AA92595 5E5CA6AC2D34AD57 E826C54FF9D04C86 0DB737B03A05447C CBBC1BB48F0C5E3D A9728E937677D721 26876CECDBE3A254 498D79297A8A7516 D7B1F7C692B37E1F 63ECEC0591737A18 2F250788D2A0A9C9 E7073E6FB30540E7 F0EEBEA307BE0895 32C29E485368845E B622691615761E9F E4726244CA8F4CCD 1051983F1767BB9F 39311C42A87DE622 0904E852A17E29A4 B6A89BBBA1FD6EB8 815980D6556CB897 52070FAE758915D8 CC7170DBDCF4DA60 768383593CDD456A 38547A1C2373719A D23EFDCC35F88564 CA342DB9AC9EE3F6 6AAAD2AF888D7390 F67F6C0E51EAA636 EBB93DBBA2618592 EA4E2E0ECCC43952 24526CE7D0728B2A 09B50C6CB145D5DB 2484F29D4DE36CE6 1635ACE8BD514958 1BE8EB9EF4354552 841CC4808E1F92DD FDE9AFDEA27BA721 7DCFCB7A5D6AAC6D 33F92AFD3EABA441 E71A3D35BC0D79AD 686253FFE9ABFF5F 5C6A8EFFE3C7A0DB 6256875A6F15C029 8D93ADAD2DD733E3 350623CE841C044A DAA7280CFEAD7D4B 1B93D019FBF6F943 7816C16EB09AD2E9 E70A779C1F77B8C5 15F908CEAEBEC4B9 17938A43F3526826 F6FA9DAE02E4A088 01C4716DA35F6CB9 A4BFB484227C8AC0 A7D3817AE0A2D74F 2AB552F6474F43E4 4843D02CB89D8BA9 F58D90493BFE7EBC E0580DF845B82F3C 6FFB2644318C39A1 7AEE7C9D9210843F 9396E76AF78CF8B4 560526ECD5124AA4 46CAC7FA231BEB3D A9E9046A88F18786 4855191865B216EF EE16AED0494F66CB D2D8E513BBCA8B6B 12CC02FD368CCAC9 5674D0F9F1E3FD9A 25B72F947D1345CA C60CC5D2817DDE3B C056795AD7DF0C84 03AEF8E4D16335F4 67E6A13E12AFFB77 9644AB969FBB7691 53D36A7E54824736 945307DA0BB5D0CC FCDACAFEE1D40282 8649E7E563533410 F2973AC9B2D1B1AC AA1A59D3960B87CB 36380BAF329AAB93 E28EFE83302BA4D7 487FC4159DDAF4B2 C198AB902F1AFDB0 B63FA3A3DC6B0DD4 9F35B31492165BD7 4C3DFB0884014C04 B2EAB6D18AC7E3DF 84CBC0E7D217F621 4E01A653EB076BF9 5DFB263DF362C42F 99BD605E9C3270F7 D385181686F02BE8 E1BB9EA2A6F40A95 70B78700750190FB AAFE79102A3664CF FF0015805063CEDB 27F6514684AAF06D C9C4BC79E6EC1279 3D49B5644D82C19E 6C070602090F9047 D8E5629CD15605DA 064272C80D1FDD7C 2A05B7E863E4CA97 87776341A939052B 979B6B86CF4765E1 F2EA806EFEA5AAAF 9524DA9F74E9E276 E23B5938EE88A80D 773F3E60FBD30883 82D45E04FDC89050 46AD2841F7DE3082 30553176D0E588E5 42B5440C7EBF5816 C14E0988714E4800 DDC9AA2D9C99E4FF 47E63E8E4BF564A0 B6E7867CCDD49E36 14089EDF90BEB0E3 D54EF4A17EE09008
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201307210905 (name+title). Key = MD5(password) = 04c2bd34efe06ff165998fd97382357b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1339245e-d816-2972-9cbc-e781222e939c
  2 7bc10323-39e9-1a2a-916c-8403bcbaaa3e
  3 11835094-d8b9-8a1b-86f3-77a0eb5de595
  4 307664d8-9569-59f3-a8a1-7af1efa47e24
  5 8a6b766b-c14b-8b2a-9465-5ce8fff255ce
  6 279a5c14-1043-176c-b0d0-5301c0a5d0d3
  7 ec09a02c-9643-10e3-8b29-7a5c3f0cd5b3
  8 8f4769e3-efee-19b1-b260-b842ce4a0f36
  9 ce9a18e9-b099-668a-a336-a1473e404486
 10 a2c8ce1d-cf55-6f2f-96dd-d6bbfd43b225
 11 8c0a52d9-4b21-47dd-a051-2dfd2a261780
 12 ed787632-12c8-2682-ab4e-f5fec794d058
 13 ed6161b4-14ec-4dff-986d-78e47cbb5d63
 14 33f54d2e-78b7-4fc2-bfc4-59a59c4a3757
 15 611c48c1-9186-7c45-9a9c-f55758ba408b
 16 4f8b10f4-ec47-73b6-b7ee-228c42e79d12
 17 74230f29-caf2-2f64-8b76-817bc981b659
 18 ab129980-bb84-467b-b7d8-0f5caf92869e
 19 dd3bc4c5-321c-03b5-90b3-cc1b1139ca0d
 20 57330311-7640-821e-bf0f-f2dcbc182bed
 21 0281c54c-119a-0eb3-a163-fe35a3166af1
 22 1ac3b40c-7864-6f93-9993-878031720402
 23 66db5926-7cb7-117c-89cc-e1560e48fad5
 24 30482c2f-c0ef-48b1-9785-d40332a3cf36
 25 ad09f278-4aa6-8e6f-98a5-39bb7cb47efe
 26 6354cb8d-9bd5-6ff0-bb5b-1540e2b7611a
 27 ae54b635-ea19-3f5b-9d57-864c519bbe29
 28 9a8c8e09-b044-8b4e-917f-18007e3e30b6
 29 45471683-dc72-5b95-b717-c546e0243e91
 30 02264c6a-f824-4e2d-8056-4a1ebb72857a
 31 3b13aa2b-e3e9-7fec-ae88-c66463025812
 32 44e738eb-92a2-2fcc-989f-5e33043708e3
 33 54a77025-884d-5553-b109-39aaad5cd1c7
 34 ec734ac5-30a5-8d11-bcef-dd285ed1c7c2
 35 4c8a1c9c-eac5-06dc-ae81-12eaef08a003
 36 2a5c378b-8b36-7117-9431-e52af137ae35

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 218581116642447724080614863854725807. Exactly this sequence comes out of new Random(717).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 33 of Run 49 (seed 822,652,546): new Random(822652546), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-07-10 11:27–11:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs