A858DE45F56D9BC9 archive

201308260229 1l2ub6

explained decrypted filler

seed 866

Metadata

Post ID
1l2ub6
Title
201308260229 → 2013-08-26 02:29 on A858's clock
Posted (UTC)
2013-08-25 21:59:56
Timezone
UTC+4:30 · title 02:29 against posted 21:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201308260229) = 9659257331b789b57b5f53098e8d4b64 (name+title)
GUIDs
36
Filler GUID seed
new Random(866).Next(9) ✓ verified
Run
Run 51 (seed 714,271,718) (seed)
Draw
8 · predicted N = 36 ✓
Machine boot
2013-08-13 23:35–10:35 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 1
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E85D788E911826C3 8567D6A1ABA9CECE 9AF4E8DDE8859A55 5F7DD1D61B1BB871 3576B7D8A335BA12 533CC73F8B28FC04 B75C283FD9CA2709 46552D725CCD028F C8C2C862C6D8F9D4 D6FE6CD2A12D86BD 84828B4146C1A97B A3E27B66D12D5DAA 3BCB423CAE1C126C C054D8A09C80525F 5AE83C1900E3BE7B D3A035AEB8D89D4E BB0BA72A958D5CEA 5A679856C10266DE 3F7086009F925190 FFF79E37101D44C8 D4C676EC0E24BF0D F46E53B9717B5295 593255B4F240599B EAC9B61A8F0B37FA BE69ACD74D1D56C6 E576A7CFAFA176B2 5AB5D982C99161D6 B669C601571C6991 C8FF5FF96BB38BE8 923AB78193F2AEC8 09A83A92AD753966 C00A01FA8A0AF48F 30D5B614BB5B4E87 B3DA1170C36BF7C3 FE0FA6482C4554D0 6ABB3E9322CA03F7 D7F73CA1C609246F EEB5E2A249E0948E 1E74FB4ADB5B69A0 74D469FF4CFB5F73 4C672B18EDFE5D1A C9AFDAC9DB2AB17C 6152669A7490866E 22AB9CA1D27C3D08 E370520A66057CFB 7E3A23131AA4A7FF 478D91CB33670D4E 501C3A8B5062C350 B3F5975F60BDAE01 E1450840F1B8AAF3 61CE2E6603E756A2 7E63CD2E0DD783CC CD544F65754E8BB7 AB3EBDD9653C57CC 8124C63FB5DA38B2 CAD6A7C7AC839632 C32585C38AFDD150 F91DD09B948EDB7D 7D4E1290CCFC14E3 7816439A319469C7 76DA596F10A51286 09E07E3B2430687E 84FDAF25D0DC59EF 5A2EA676CA2A20F6 E8AE38B35C9B0B0F F0ED4A69D5A1F624 9F36CC284CEB36C5 178C80D5C3BAFCBF 82D0000CC56581EA F39BB3EE227D39A3 46DE2C747C629632 864E2509490E294F B79F48B74D312B24 F7E01F06597AAE9A 11194AC5F5B0811E FE5A92B79728B85D 48C9D764EA8DE346 C7227F05D50EE508 4C90E1B4C6966405 86FE2FEFC1F08820 7E8E9F6651D290EC 217C95E99BD70D45 C66DB6F4B3E1BD85 5B73443D5BE78634 1A7BF7A1DFA21BAB 4947049D51C9D77D 2C25D16453FC7236 7C67B0BE503B34BD 4BA0E557462FEE0A 1835EDA410C69473 BD051395205DD62E FB3FC1B4F9F9151B 46CF988367507171 7C1B8E6658BE0227 609DE4641E729566 AE4DAF9114AF5EBB FC0696C3525A120C 030D257FF5BE4EC9 8BB537F7E279C8A1 632A3BD2583F70A8 62B4DC7B7FFF8E6F 40E71BCEF1816566 C63E56E1103399B7 EF2A31B1FD10E184 57BB965D1A43E4CE DD9F11C74700E58C 15A64B795AA9F1B4 E633CB1506BF3D13 0A8827C686758598 0A888DB6A9CD36C6 6213C095D9BA1B4F 4FD7ACB033C7090F B459ACBC28A95AD5 A3496300EC9CDD10 AEC4B4E52746ABBB 8ECF291E854A4848 0B731F605A99E6AD 5A906F2FAF76F85E 75DB9B0ED5C80EFD E5F9971450FD4D36 14D6C0EE307F361D 5DCFA26CB1BA8ED6 3B68FBF52BA6E6F5 B6EA29C2DABE4E12 B8DE7C7E1FEE9DC8 594A2315EA2CC4BE A6165019ACF20CF4 8D63C1609F6868C6 94B12B0E6DE2B39B DCFA52020B0612DD 9715D39EA5C53D3B FA1FFD105D80D3D3 F0696C4EC81BADDF D8CBAA94BD99512D CF83B19B7CB2A6D4 67A969859F022AE3 B12D556CC1FE6029 04D77E7D2298CA32 EFB7C1E6166B84DA CF1CC49FFDB28EA5 C28F8E7A5C15F0E7 BFD5619656EDA444 0D2069F7C4CC03A8 210C16A5938315CB 69FEB74E175E4B85
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201308260229 (name+title). Key = MD5(password) = 9659257331b789b57b5f53098e8d4b64, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1071a7c8-e9fa-19e9-b4a1-2fc297555280
  2 fb895013-61aa-842d-9e0f-89aad3732032
  3 3d28e477-6994-055f-bba6-90f762221967
  4 ac4ddb2d-6044-3ac0-bb25-c4a667bd8d94
  5 48e5a362-51f6-1fbd-b725-f87fcad4a266
  6 92be1019-e7f6-3ca8-adbf-fe46dec35640
  7 1b2c1fa7-5415-8140-be77-9d9fd1340ba8
  8 a04a27b8-8f6d-8f46-af3c-15a7afd4b0e7
  9 215dd897-ed8e-1862-82d6-23ca1b018331
 10 2006c339-bbc1-5066-a464-f34277e7ba74
 11 e340a566-56ec-2691-9db1-bce524553f07
 12 ec1d418d-4111-5706-8388-5ba283e96975
 13 2f373c34-260e-8bc2-b567-31e9a176d7ed
 14 aeba0708-820e-0ecf-930c-d9defff3a914
 15 05422176-e373-1dd2-b25d-be246d1deabc
 16 829bddd5-f89a-74ed-a7da-8a38c8b32ea6
 17 bfd3296e-af94-87dd-bf8d-0267d521e834
 18 05aa1685-f4ad-8758-b974-4a7d8a973b12
 19 2e31e972-1e83-1797-9432-e0d4bdafd97f
 20 24c515fe-aa5f-5b32-986f-0a59cacd738a
 21 dd2ad280-0d71-7aa8-883e-e74d9856583a
 22 5aa436f9-84b2-2ca4-ada2-0678ff6f3056
 23 e6008c28-938b-3944-8d84-b6a6a74525e1
 24 74fbbfd6-c621-5111-b255-e21b966507c8
 25 b6f458ef-a4ca-51e6-99f2-dc3ae10accbb
 26 53195346-a5db-4af4-90f0-a8bffd69fcc3
 27 9b2709c5-89b6-4801-a5ae-bfa034d5cd0b
 28 e727b156-97dd-27c0-a646-fe9fcfe55334
 29 dc717790-55bb-6bee-85cf-12ce136e9f81
 30 61c77806-321b-459c-8511-0a5b6411a261
 31 cc6567ca-bf32-84f4-8065-7280a9d4d83f
 32 5b73284f-51bb-5dc3-b93a-38d7a28cfeed
 33 785b3f59-7360-4acc-9ef3-bd545d976eea
 34 5f0f9fed-0d6e-65bc-9588-2a594c12d11a
 35 ec13dce1-6b0c-0a1c-b223-98c8bc9ff196
 36 bebe128e-24b7-2f97-be81-6b9e67a33b2b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 180313881525801788157235544264854602. Exactly this sequence comes out of new Random(866).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 8 of Run 51 (seed 714,271,718): new Random(714271718), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-13 23:35–10:35).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs