A858DE45F56D9BC9 archive

201308100906 1k2s04

explained decrypted filler

seed 965

Metadata

Post ID
1k2s04
Title
201308100906 → 2013-08-10 09:06 on A858's clock
Posted (UTC)
2013-08-10 06:06:55
Timezone
UTC+3 · title 09:06 against posted 06:06 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,576 hex characters · 1,288 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201308100906) = 0b2c6c353b79c72e624bdcd45499feb8 (name+title)
GUIDs
40
Filler GUID seed
new Random(965).Next(9) ✓ verified
Run
Run 50 (seed 2,278,890) (seed)
Draw
35 · predicted N = 40 ✓
Machine boot
2013-08-05 20:29–23:29 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B17E8E76CC2A1F27 6FC38870FF8CD8F4 6A6AD36348F523AD 5445CF28C30F9E43 69950E203755E7B3 4C4EA8475C333A94 3CFCFA7BB2F4BD52 5315152F8862476D 86A7AAA10837ECF4 27869A2D804634DB 2F9E56DB8E760494 6D9C3C52577E8DF1 7F01D575E3EAAC69 29E0FF4E12226E9E D0810946561B10CD EB51CBCE46998354 2866D23E7AF10A8B 22B56EB0D792F574 98A3258BFA35E550 C7836BA0792E175F 0AFACE57BC8E0883 D67AC1AC774E4531 0912024230AB8B82 7E0C63592FA45618 45604F0763D98D9E 6222BB1DB993D8DB EF5A065EC9386FC4 8106FA35B395C0A0 4231399B3CE91C34 79D5577FA9DBCC7F 3FFA7C5D4BBAC559 B2EAF5D4FA7A2F78 436A397A57D80664 E1ECE7D504537D32 4ADE5B865A8B807F A752EE67E0C40FC4 66A87DF3E4DC3AE3 E4A3B595A3DD5E1E DAE07B9DD28FBCE1 DA77A4EEC390AD48 777EF083F0E77E34 773A4244BBA572A4 53602A01266282DD A6AF3D7029A8D423 7D78C74520850EFE 2F65EFB4B0CC7875 E9D7032CCCBE9E45 42A41BB95F72B630 6298EC806F88760A BF58E06FF5CD0C80 11645E2AE731B429 BD3D65FD64012741 423571218FC4C23E B46DF741851646B4 B43942BD82E82A74 0F8A7EEF6A42BAEA 6E9D8709CFA65D88 2AFB4AC554CA27C3 CD8EF6E3C65C9312 BA476741E5735353 1C473F1EAE77E43D 948330CC621A2DCE DE10420767B9EB2B 832CB1182A8F1D7B 964F6E1193C30997 0629E165D46CF9F0 FCBAF9B1039892EF 0356BC16E3FDE1BA EB07EE4E04DA2686 A63FC12663D485C4 C62E8AA7919C8666 0EF2C6DEF268FDF7 9A78118211D1A933 6098113AFA5EF82C 63704F8702D4C0ED 1B504AD1C33FFB46 ACE58A307F31148E A8F8D67F71A43289 6CF5A9EA4C550D93 5B7C6BCD76DBD25D CA1A2E8AFB7C5F1D CA6DBA41960EE22F 96FE07C3561AAAE7 093664C36BD886D6 3C12436A9DBD2EC9 8F7C2EBBED3AC0A9 7F41FE89A771438C C998293474841950 D5C82E66EB99B223 3FF48C9E574E140C 2614CD44677C8EE4 2C05128FF3982271 9EC4D7380542668B 560EC8840A07EC3F 48D955DE3EDBD76E EA592872FB9B4B4F 0B8CB1C85A6CE438 03601EF4F7533F9A A97707E637F867FE CF0BD6903E8FAAD6 4FBBC71B7E698806 F3480BC8D86AC1AD 95C58BE771785116 18391CFD25B3B955 E8405A4D8BBDE8CA D08611812714E8FE 023A0A884B486558 FA45A0CE92635893 AA4EADCA81FB2880 AB7F0781D19BC506 E4D8D24FA8186F49 54FDF3B5630656F5 49957F22755D37BD 0861DE23EA35D132 01C6168DB92D4D80 BC2E868C1B8D0A2D B15966512C733FA2 88BFC14FC89FB810 3379C79589535578 9D36D1FAB819F912 5CEAE244E8DB84B2 082AC88E769CB5F0 6261EF08D9113132 08A7669377A5D7C1 9C208C7D7862265F 892FE25EC8487571 C6CADE67E2CDBBEC 4D079BB311F9D360 238012FA329707D3 A2872E261421248D A5D5F2A275484B5B E84EB0691BC22316 B35EAFE00460487D EF9F910734EFC0D6 E68C571533B02D0D 126608D548DBA549 4F032D681D130144 BD6169F7EA2BCBAD 8DEB0820696D6266 C0026F5D4EFEEC02 1111DBA234BF091B 767EA866603DFB58 DC43ACDA96E07FED FD9828E686F6EB28 0999B4052651B6FE 1A938F438FFE5501 E56EBFF75409183E 744856F841D1CC2A D12B860B718D791C 6A664C6082C29C3A 86E42E51BEB52B15 56012FE546DD4CB3 92AC420FC4D8C9EC FB7DE17CC858B325 E3FF5B8BDD2D6211 705A10B92EBEE8CB 2334FD1BB59531CA 00826B49B8117505 2F982A27DDB2FC6D 08ABC9C33FB1B828 3A8EB2DF0CFEFF0A
  • Read the ciphertext. Strip whitespace: 2,576 hex characters = 1,288 bytes = 161 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201308100906 (name+title). Key = MD5(password) = 0b2c6c353b79c72e624bdcd45499feb8, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 40 GUIDs as hex (shown below).

Decrypted: GUID list

  1 856b91e7-3460-7524-b52f-004c8e032512
  2 fd25537e-5aa6-8363-811a-aea5cf566b6b
  3 6632c252-0ef2-20ec-a4bf-9dd1e42418e9
  4 91e57bd3-de10-49f5-a146-541f1ffe580c
  5 68ee7a04-e63c-8f83-b93e-fb7536bb927f
  6 c9566d8b-c9dc-7fd0-981e-7e3036aabe10
  7 295b4809-d5aa-2a29-a747-0d5c9ba6a599
  8 093c0501-1ff9-5641-9626-32b973728df2
  9 bcc0f0c8-939a-3301-b0d5-f67686a11f96
 10 0a42aa3d-757c-1c77-bb2d-49fbe16b3bcb
 11 6860919d-24ae-20ac-9d9a-5f5158fbb410
 12 4832dfdb-aa83-7a53-bcf1-6338c306d4cb
 13 240e70ed-dfee-0bad-b184-d6ff54ed4ddb
 14 6eb1a801-c66c-4778-bcf2-ccae82ad82c4
 15 1b5676f9-fb77-4e72-8b77-5a12a58499aa
 16 c9348d5e-593e-6e6b-a8fa-1c63e5def277
 17 db9e5062-d633-4a60-b3cb-7dec678ea1fc
 18 6519cf6d-6d08-2184-b2df-0d9831b980c6
 19 4ca1483f-5bb8-7145-9010-ecb65b0f3675
 20 34b985f5-ee21-8383-be50-25b891c1e38d
 21 4e4bfaf1-451e-046b-8687-3041fce6fbb6
 22 fecd5489-73f1-5b0c-ba91-84ed36ad8e09
 23 56742f53-3885-0010-9e6f-e59a652c11a5
 24 885a114b-db7f-170e-89de-9feb9f766eb7
 25 7b91cf4b-a29b-2527-b391-cfa5c377f983
 26 35266d22-45ee-11c8-a98d-f827300143ee
 27 21532bbb-2b18-5f4e-b78a-80f677f6ed48
 28 11eebb1b-cab6-5da2-b921-f5e9acc76feb
 29 a45b5132-1f15-0c45-bedd-e5d30d5898ca
 30 098a7e11-a5cb-2cd2-84ba-57bc1085ffb6
 31 36f5dc22-52e5-3528-b2b6-67059cdf906e
 32 a5797643-7303-50d1-a9a9-a91081c735db
 33 305616c2-067a-3996-8a91-d6109daf6993
 34 01c1e623-f043-13e4-be11-ee0809a2be51
 35 d65a675e-c0cf-5a8b-b9e5-da460ec587da
 36 3a41ffa2-fdfa-587c-9cce-ef6e4566388a
 37 d51a96ff-a1e9-33d4-bd7d-5f9fb8a5196a
 38 2c0fe714-1ac1-0f3b-b29a-4ff0625ba6d2
 39 4c88d9ad-2c56-5d02-8731-cd96088b4162
 40 291dd1b3-c237-7863-a626-bb98d95d79eb

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7824872531270446427805012155023531553057. Exactly this sequence comes out of new Random(965).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 35 of Run 50 (seed 2,278,890): new Random(2278890), 4·Next(8,16) per post. The RNG predicts N = 40; the post has N = 40 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-05 20:29–23:29).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs