A858DE45F56D9BC9 archive

201307230914 1iumek

explained decrypted filler

seed 651

Metadata

Post ID
1iumek
Title
201307230914 → 2013-07-23 09:14 on A858's clock
Posted (UTC)
2013-07-23 00:15:00
Timezone
UTC+9 · title 09:14 against posted 00:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201307230914) = 7eb3791718dce1a35135c40fd8d79596 (name+title)
GUIDs
36
Filler GUID seed
new Random(651).Next(9) ✓ verified
Run
Run 49 (seed 822,652,546) (seed)
Draw
67 · predicted N = 36 ✓
Machine boot
2013-07-10 11:27–11:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7E2214F4BB80B44F 2321D77DE6CA7F4F A4E4D781B8132BA2 6F4A84BEE9103124 3B75FED5354F74DA D1E3963D0B360FA2 7C997CB9A75E9129 7058C78BEB12AFC5 3AC0681EDE049C5E 21BE15F9F141EB67 4AEB0C6325CD2146 F5254A591DB536BE 27DE4028FB3593C8 F77EFB2BDAEDA544 EF856B96FB0C20B4 E019276EF05557CF 8645D1ED30E48B41 B82A9EC1C959BB29 039A1DF256CD1378 C3D303A0959D9560 40E41548B51FCBFE 883EFC5C1667514C 708121BE7E67CB6B F562F4EE43E33D58 71AC5260851EA8F0 59AE7307D32886E4 CCB1DA56E1DB5793 68AE655A1AEC6123 874EF5D463AF90CE C4D51E93435C3745 55912FCBE6842459 1C7CBA8C28D0BE60 D4CC6A79B1B63FF4 606F92187CA54D9F 37D9D911BD4440C9 3C6F1D2EE8C7C5B2 2D5878FBFA762BF3 9DC948F88988247C 58B0D6DBC5F7CC28 C12FD3B111964873 14DDBC0140759850 0A6CF7C53C08A390 BC46B5A0123FFB6E CDDC959D33318D74 CC6EA62FB7C04B20 1F0444986202DC53 4A1F544C0C2EE0AF 173F23FB0B2734BC 0406D18F74B8614A 9F25894087867D80 20CCCE4AFC1A9051 C99E05D9D0714DA0 0EED7E0DAA95AD92 88E4378472C91082 B3DFDC1FC9A0978B 34981F9D6FE27E03 9702ADD7893666EB 83170955649614EE 748F5AD27E2667A9 B5371ACCD17DEB78 EA2F6412E08FF4A9 CA4AA93B31BEC210 CDB833CD41B6ED37 D0C72E5517F9A75B A2653C3AA7CF116A AA652BC32341E6E5 B167A24099AF8E78 E9B882842D42E377 B8843C604A6D630B 744EF8E0D066D78D 78E91E3A84C89C7C B0D9F70B70053392 C986D4A5BA4F39CC 8DB25D909ED1E988 BF426CED1B28C84B 828D4694CEB7EBF7 4EAF521D2CEA84BE 5DAC8184EB4845D0 8E08BCE595A226B3 2970482C3F2206B5 D6CD8C8E7D283F34 D2CF443DA139FBAA CDC9B7ED12A390FF BE002E12D5B5B5AB EE6323FB106E80CB 1637BF2A1C1D9E59 C6D3257BFF97E7E7 C51436BCC4F076A5 3E11AECBF2B153A3 7E7F97E5CB15E03B 33C86E842B05AE2C 27C048F19C16D5BA 5C4F31D9AECAAA11 94AFC8C357331565 BDBC299DEA9948F5 6041A4699D60258C 2673272E406BBCF3 C1DFF6313DDC1F44 D30E508EBBD298BF 03F18CCC5B87AFA8 167D5F932714A669 BD000D5B7C665E2F 422717EEA2124566 AC55A3DCC90B253D 94077F4395A4B81C F167EC55613771A0 CF45126A7C171689 90356B9C646C3FCE D5ADC5040E53F678 AAE2FAB92DE01768 5EE932A44A16B834 AF7E35D26A072F0F E958D2BD0CDC6A35 6D67062F35DEE94A 070EB12243401B94 CED4C79884C0A995 FC02A75A3AE0F8CC 8142F8927C0BD11C 04BA1EA3124C66AD 9044CC60CBCFC9A4 0F19AF9E3F71763F 6A37566E3DFB2AF0 6C4FEF250D892675 55879B5D68E38FA5 FE63B29687F0C8A6 7D4F0021964A2E2F D6A8833C68D2157D D39E8061EB72D6C7 787580E0E2858934 B4EBCAA1B2EAF709 2E68A87FB77118AC DDE4D48D073E6863 6E7DD5D3867DFCEC 14C064A7FA56D799 D1861C3E312E4AEC 9E3F97067BDD9BAA AC02506CFD0A4DB9 361D1D66776B7ACC 752DA1858252C06B 8D2C9A2921407007 D4DD6A44237ABB17 B7CCA09850EE1C88 12BABF0A9A297A12 CF5B290BAF101780 A8066FE7885EBC9A
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201307230914 (name+title). Key = MD5(password) = 7eb3791718dce1a35135c40fd8d79596, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dfe27172-d6ed-7ca0-9969-f1ed29e2c9ef
  2 d7beb365-829f-72e4-bdb7-d9b7c6e2d3da
  3 85e82a2a-fc22-7653-a4d5-f18135d6f139
  4 5f6b5b70-f0d6-4f84-9231-3d6fd2fd6aa4
  5 50133a54-03ed-136c-a1d9-f3e75ecc0caa
  6 47de8f0c-7a7d-48e4-a7f2-f3ef09aaab76
  7 d8833655-2d58-5f2c-99d2-035956600e57
  8 fdd2839c-5ae4-0a5c-864a-0421a31c1542
  9 2335070a-ee4d-4ab0-8b8e-88df0f26a45c
 10 9e3d203d-eb0f-2865-b149-db7ca6c89042
 11 fd6bf0fb-cc29-829d-bc6e-7247bab35891
 12 a6a30457-4cf3-6822-ae7a-aa24a86d26ba
 13 ad60e4f3-1bb8-1730-a974-459f08563a46
 14 01e33ee8-cc1c-150f-a3cc-97d513859aab
 15 e019083d-c47e-5810-8bab-6142f17bb4a4
 16 7ca4a103-e6e7-507a-a301-e77bc196a552
 17 17584bdf-bbb9-4f52-82d5-1fa4d0cb3007
 18 8b2b9d86-d7df-5d09-b9ff-59d79051a935
 19 1b7bf458-63eb-2f8a-b847-86b5d046b100
 20 b734a572-9a56-3588-894e-de9cf2baedc7
 21 2bbf84d3-ed92-2883-83ba-a20baddded72
 22 f9ed7a53-6a27-5bff-957c-c2c90f453648
 23 b5a29aea-df76-0c12-84b3-56a7b3d476a7
 24 38616cab-8d55-48d8-be24-cce37b0ae625
 25 32c9312f-c0ac-44d1-a696-96fee5606310
 26 29fa8437-87c8-28bf-acb0-a31b6e60e5b9
 27 7aa98b4a-7f75-59e4-966f-9f82d8f98689
 28 90f21a51-cd10-0406-a9f6-b60cd5845cd3
 29 c5a88211-7deb-3a79-a1d5-e5e38b3ccd0d
 30 8123cc99-0e49-39a2-96b9-a5a1dfc3d359
 31 d1202705-1f9b-4187-9661-1c00df85c8c9
 32 1c820a06-c10a-82c0-a21c-f183b46a75ad
 33 29c738f3-3666-0a9a-bfed-900b552980cd
 34 3d1cd6c1-8070-22ef-b10e-c4e15970e57c
 35 cf8ee860-2e3f-81b2-9b80-e6d02ed771cd
 36 035000af-b893-8d19-bb50-eaae09b6b93f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 777414504286115545232504425033480288. Exactly this sequence comes out of new Random(651).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 67 of Run 49 (seed 822,652,546): new Random(822652546), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-07-10 11:27–11:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs