A858DE45F56D9BC9 archive

201308081506 1jy8mk

explained decrypted filler

seed 949

Metadata

Post ID
1jy8mk
Title
201308081506 → 2013-08-08 15:06 on A858's clock
Posted (UTC)
2013-08-08 12:06:57
Timezone
UTC+3 · title 15:06 against posted 12:06 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201308081506) = 228c8c84d3a31e1d8b525081da87d6f4 (name+title)
GUIDs
36
Filler GUID seed
new Random(949).Next(9) ✓ verified
Run
Run 50 (seed 2,278,890) (seed)
Draw
21 · predicted N = 36 ✓
Machine boot
2013-08-05 20:29–23:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4509333886446200 779458E061BF9A47 D1427BED30271C5E 92F31F1487AECB09 187B209466B4D0E1 82C023E3C1BC7635 4DF9E167F6A7D0FE D51221E29CE31888 6B254217249EB838 1BC60A75C365AAB3 C0E6C5B87D3D558A 0F6563B48F1ECBBC 4FCCDBE56242F8B3 D7B28336FE1CB7DF 81327F1E1A524121 0337EEC22C14CF2D B5B06C5C870222D4 C79E3BD374893E7F DD63CBF003C3B1B1 23A3F5A407543189 70487D9D0F26980E 54D6B8AAC2184960 40ABA2635208C8BB 0E05BF61B14795D6 B39C9BD583937E2D F17AA662EE23E193 F85186F5DFE9C27B 3782A10074581166 AE47CABDC8C06895 1FB9E6D607447A81 5535F975B4BB938C 3E7CA91C66D59B3B D058F67840EC1CF3 2A1D3613338FAF1D FB35C841AA109A75 E23D945846F04011 441D230A62996EF3 83099738C2DEF36C AA85DCEEA184DEAE B260D9834179EC3D BC6A2B8FB6B2D888 0E9E85CD358FBBF4 7BFE61BA5285E099 7CDAAB23107FD5A2 21C17B2B4051798C 6729CB98657BBCF0 9D7B07EC0DFD5FFB 155376A4945EFE0F FB2AA07E2EC7AFD0 61C1FDBAAA532CD8 49E907D3083E1124 A134AF98CEDAD563 A0EA7AD3FCF6CA0F E4AEBDE7CA6B0426 DC8AF3A0434B44E4 B18A92641146D453 6E44C7DA15649D10 C3D8A9C7888490E2 42D2487D16EE21A7 817509109342A93E 05E3665D73A03032 5BFE8E31F95D68B0 20EF205DD53D3727 456F77775F8EAB5D D5CBA0EC13D336F4 8DC4824AA155A61B F438731DA0557B99 7BE6F11E173914B5 81B6E07216356988 63D983D9EE992505 797040CFB87E43AA 19BBC58E9BA6A12F 1969712168C6EB97 B84832AD761CE893 A0AB591748C1EB1E FE16339821176D2E AEFA898C8EA73E94 46EACD7FF6EB7695 EAA880E2BC59ADFA DFB102B1A18D49B0 189720A0D43F05B4 D69B5C28B665A814 E1B3E67FF202A68F A0B2E62E5F8CBC86 BC093098AF35EC61 43E2B4F1435E2AA8 157107F1D43351E8 1F06A83B108DC712 A62C91E56962F958 4F6AE7242BA32166 150FFF29F5982D5B 69EAB83250FC2CD6 05C745580B9CBE24 EEBC7B3C7F8E5057 F9747172313E784A 5B46BD28302801C0 F6BC9A7139DE3449 E46D2DF3F6209F19 393734916738E433 45C22A6C18E9E45D 0D044F94E5E7F44D 69CD25B958699123 0DA375CF14240CC1 4E1484EAF380CE62 8E29EB8FD95F946E 0D57152771881A96 4DCC1837F53C755E 5F2E112E2A664E2F EE44465D5672B915 A878CB059AE1FE51 2F84A053CAF8AFEC 59B97E0484CF5E52 4456D02336D6B86A 50B73AD89F18B784 A79D08B23D3379A9 44D273ADBD60B394 1C16CA7355D85AA1 EC1DDCD2AD821D4E D4ACADC417775610 784014D9B0F89925 442E3643E0049FE0 BA7CAB9C4A7199EE 9059D9AA3DC899A7 0430428AB899692B 82EB4D4F7462EEB4 D8340E37136989B0 A5CC45346095D4BE 820A74C538DBCDFC B9DE4445A0A5C32F A2228379EE45688F 47CF46A65FB1D1E8 AAF94B70AF547E79 8EC55713159124DF DBF477F1340CF08F 2E60AABCE2533F5C 30E709239FFD9F26 23043CB0A85B9770 3B327D63E0E22313 77E5BCB74C4AB483 9FBCDFE15EFFDAC1 C7E5A8CE28C57BDB 5647D3242D3CCFBD 697303C4BF67ED4D F7F9B8F19A268429 934316C54E674D25
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201308081506 (name+title). Key = MD5(password) = 228c8c84d3a31e1d8b525081da87d6f4, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e1f4e840-b0b1-4cb9-8b83-2f5920108af1
  2 5dc12796-0c78-2bbf-940b-4a79c5c23fa7
  3 f96c3e27-5d4e-0c27-a4bb-7672c9971912
  4 7f17cc5c-fe84-1e76-a042-eb971a4f16ff
  5 2e25d320-5231-511d-8d20-634155f47cd4
  6 add9e9d2-238e-7497-9a12-715e9e4e90b9
  7 208199cc-bc0e-1f3c-9147-63bdfbf8215f
  8 63224033-bd65-4997-8250-d037436d1995
  9 e002dbaa-55e0-30af-a663-186d02215db7
 10 92a3c232-4967-1e2e-8cec-b052509f1ebd
 11 0bc57862-c7c5-4608-977a-b2be2686dd50
 12 51d56813-470b-36db-b2d8-7d565d5f1813
 13 af3ae36a-74a8-08fa-8a8c-1622cb8f01d3
 14 f9ede758-8361-141b-b9fb-a43d550f6af4
 15 d8e883f2-b988-20b3-b142-bf828f714d9a
 16 ce4993f1-f798-6d4b-85c8-7c9a73a51127
 17 dc8af66e-b158-7b4f-91a3-de14143af105
 18 09567edf-9744-364a-b377-4bddc667313d
 19 d4fee1c0-0748-3646-bb97-522881539172
 20 cc5d1901-76cd-6e0b-87d1-858ebae0b044
 21 d2c308a5-5a27-8a65-aee1-9acf943e3e74
 22 60b31194-197c-627f-9521-d6fe41a83980
 23 d82bd942-b562-333d-887e-338cd090ef57
 24 32cf3769-9bf6-5b1d-9af5-9a1a0419fea1
 25 4725ccec-fbe1-69db-a01c-78d1cdd446d1
 26 b13a99c6-1d45-89e1-97c6-08839240b955
 27 ec0d9b7c-cc6d-7306-afe5-05bd0bb9d97f
 28 c4112778-f57f-6c02-ad9b-a5083edc46a5
 29 330ff7b9-fdc5-604e-8c57-a333d5c7805a
 30 c1026fdf-a598-340e-96f0-c5e4def2de97
 31 bb1895c5-bb7e-4827-91e4-86b6f3c267c4
 32 d1cbed86-fca4-3e96-b8ef-97c7f50087a0
 33 31a5a23c-3a71-89df-b69d-ed3e704686f1
 34 a6bc24d0-fdf0-72c2-82ac-31bcc6402fa9
 35 6df11386-feb9-03ba-8ca1-59ae7b193c9b
 36 aadbde6a-8ae4-84bc-bb85-08baf35a861d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 420157143143012673368635687663438708. Exactly this sequence comes out of new Random(949).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 21 of Run 50 (seed 2,278,890): new Random(2278890), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-05 20:29–23:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs