A858DE45F56D9BC9 archive

201307311200 1jea0e

explained decrypted filler

seed 954

Metadata

Post ID
1jea0e
Title
201307311200 → 2013-07-31 12:00 on A858's clock
Posted (UTC)
2013-07-31 03:00:55
Timezone
UTC+9 · title 12:00 against posted 03:00 UTC
Author
A858DE45F56D9BC9
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201307311200) = 2aeaa728cb107cf5c098455556a77333 (name+title)
GUIDs
36
Filler GUID seed
new Random(954).Next(9) ✓ verified
Run
Run 49 (seed 822,652,546) (seed)
Draw
135 · predicted N = 36 ✓
Machine boot
2013-07-10 11:27–11:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B9DEC28FA2121964 E845042FD6E89EB2 231CD635AEEA945F B2A1FC627E2B2308 E6C8DCF9BEA0B459 A7F475EC72A83050 B9FB756DBAB74B3A 8C8FC4D668333450 D39DFAB16522F2C5 5356151BA5465F80 F25A3B902104FC72 7CFAFF1411CB4828 4E4F6EC28459D154 5A3D56C29C441FC4 873967E46ED0C3DB 5AEC42CD7FC2B1EC D3FEB74ED1AC5E36 49850A2B488CC42B 30C52CE5AA88BEBC 53F842846F111AAB 1F04F4374FC3543F 4803AF2EEF96E07A 586B5CA782AC5356 0B6817FB9C65BBA1 9699F1981DC2F10B AC773A28A9B42F41 6104AC5D32BA3227 045EDC00C7493157 79DF7285027FC13A 3E4EA7C42201E7AF 4BEB023CAA27F36E CFF11E98364715B4 9AD52A797FDA6AA0 5AF22B9E684969C2 091E5745BC5B8026 7300EC6161F5E00E 7E1ACD71381B625F FC67F3BDD1C92F35 0E07E602CB23320B 85701B90727686FE A6E59FE70CFDB701 E385F452C5FFD34F 031A95155265B85C C321C31525E0CCB5 1C4A618083056AAC 8C3B532857330437 6B5DDE947F48240B 94EED166CD60E9EE 3E6E644A21A107B3 FCBF302E1BDF5508 AAEBD86533D9CF99 4A73B59D339AC094 7A9C0F6EE60D9049 C550CA169F007429 227ACDEB973F17F6 E0D64E608DB257E5 F4947E38AF733AB0 81FED059D75855DE 849B02D47B9112E5 41EE6A1EF22E8D80 7E552F2C8021FBF2 F9DC7B3793F8F09A 4314D0D6D9EFA02A 03CE8581C6E2051A 571A077C5FFE2A37 2C82AFA364998792 636871890CA4DCA7 2BF245A680F61B29 A8DB35322D8F6F8F F378F5D2944A827A 8171A75B4C78C2DB 47C806C796E15101 84B44962C6966263 FC12CF77D5F6CB52 C807478178E37F65 8D843E5F3BDC3E1D AB6863ABDE5C591F 2B39F1297F6D9DBD 5169CED4B74D485A 83922DDE7BF77070 CAB091A614E6B384 677F294051CC272F BCCBCF714B023996 B28DDFB88D10FF52 52BF9321B5DEB884 914295FBF2A5735F 3E7607AA217D8AD2 6E6C47FE626A74BB C3384C766792BACD 9F5E8E33A138D541 780AB02AE18B0611 A1163D614BA5EB51 66079BD0646021BF 4AA8D0D421E9E101 CDA59E67F81664AD 1C63044230E647A4 2B478F07DA320018 82C65E6063E4C7C2 90FD396908FDACFE 33464B216F815FD7 EC9C19D479948529 D7878539E1554A17 40FFD0B4579B81A0 FECF1DF8F5D15A8D 5453DC6F308A32F9 42C9B292F1C0518F 34216C0BE20950CE 10F3DFDC2D7986E2 8C729935F68A8213 2C1BE92C53F6B4D0 B23819257E28A54A 60D3EBA32B1ACCA6 6FDB3B6CF3B17AFA B6C0C2CE09D7A7B1 D1A8753A0966807A 967E83FEFF903FDA 9D44283AEC131B06 7DAEF987602003CC 24CCE61B3DEE9B83 AF52210D1ADFE9FA 880A2F9CE9E057D1 92B0D6511ACE8DED 2373727D910A5192 F3D07E4F42976BF0 BE7805D80FCC1660 B900B1367766394F 1E0BFA80D065258F 1463984BCEA9DDAB FAF40EE3627623D1 866FFD594E131251 D4C1F0B41C4220BD D72EDC08DDE479B0 1A8B6631BE1AFCEA A7C28177B7F2419E F935042C70F5364B B3DA27635742403A 9A46A9E8AD5F0F11 2F6A5AA4A8182B8C 52E822264E733C59 80C190F1B7CB599D A449985A519ED75F 69CDAEAACD7946B8 15B30411C04AF7E5 3192E982F60894AE 3A1762F2B97B9302
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201307311200 (name+title). Key = MD5(password) = 2aeaa728cb107cf5c098455556a77333, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 349ced8f-6564-1e58-9b2a-8e0d5dbf449d
  2 ef910a79-7215-6b4c-b530-188159935810
  3 9909e427-5c3a-585a-b30a-e9bc4f778bbf
  4 c0d1b533-5e4c-1bb5-ac49-19fc6f802796
  5 97abc996-276c-8e8e-8cd4-6776c903d3b7
  6 370214d3-2e4d-2262-b9fd-ca3bdeb50a5e
  7 5bf7b5d6-99d7-3acc-95d8-b2f72bfab05a
  8 0ed535fc-d905-034d-b638-5b9c9dd0d644
  9 9d21ddf7-9778-0106-8ec9-df83703e8079
 10 e47b7434-887f-04e9-9f52-a13a30760b0f
 11 8bcab24b-9c16-176e-b3ee-494ac25d63db
 12 ac507596-3a21-2d97-aacd-bd915e292be0
 13 a14c68eb-d500-4e72-b075-1967e3d113e6
 14 2c8f9e8c-0292-7828-8042-eecfe0696b05
 15 0480d3dd-3cc1-6f0c-808f-49e3d6b16206
 16 0b651f12-bf39-798c-8957-22d0f28b122a
 17 aaf99caa-1c00-71b5-8bab-a6d58ea2dc31
 18 c3236db9-38ae-4e7c-b3f0-dee307f44c74
 19 5dc1a324-6e87-4907-a973-02004dc48ca2
 20 0ada1a64-ee27-6994-a0a8-0bb8395ffe58
 21 02bb98fc-d42f-5f09-9ad1-c5310d39d3a7
 22 230f6cb0-bbcb-8c2c-8a64-2e878d2b96cf
 23 27435654-8064-252e-a0ae-7994d6d0c9ca
 24 8b244a62-3b24-2008-a522-d5af249bb491
 25 246435f8-9aca-1b4b-bbf1-3e219ff5f8e3
 26 8a894344-c0ae-12a8-b533-764659e462c6
 27 324f2300-c2f7-1e8e-916a-1d7826f717de
 28 e255ee00-c038-767d-bbc3-14d9fccb4486
 29 569ee9cc-5697-05b6-970e-a4550c0e579f
 30 3fd2da76-22c1-34b7-8ee1-ec60f2e70cd6
 31 4d9a4d32-68bf-337b-aafc-051caa718624
 32 0fcb7198-3780-6b63-9c3a-3726676ec61f
 33 cf873125-6052-8f80-b818-74f1fbefaaee
 34 874e34d1-1690-8dca-9011-7cd0970182b1
 35 e78520a2-8511-6a94-a9f1-e1abe0a030da
 36 a6be6795-90c8-0859-8890-928c68a9a77a

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 165182300012476774465822111703368860. Exactly this sequence comes out of new Random(954).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 135 of Run 49 (seed 822,652,546): new Random(822652546), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-07-10 11:27–11:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs