A858DE45F56D9BC9 archive

201308270029 1l4zf9

explained decrypted filler

seed 896

Metadata

Post ID
1l4zf9
Title
201308270029 → 2013-08-27 00:29 on A858's clock
Posted (UTC)
2013-08-26 19:59:55
Timezone
UTC+4:30 · title 00:29 against posted 19:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201308270029) = 514a85622e6c7611aa5fa7e71bc1dfb6 (name+title)
GUIDs
36
Filler GUID seed
new Random(896).Next(9) ✓ verified
Run
Run 51 (seed 714,271,718) (seed)
Draw
10 · predicted N = 36 ✓
Machine boot
2013-08-13 23:35–10:35 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 2
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8E0816913C9AAA38 6B8D5B3D53513532 4CE9BE1777022876 BD6DBAE373C469EF 6D16BFCAC8D3DA76 240B24A1BA6F3373 5330E34B4F586239 2A90C782FF8DC657 051FC5FB025964A7 59DEEE7C786D31C1 1CCEB88771ACB8FB B5962CADFB44684F 1BEE5182322374AE 59593D1B54DEC24B A9D3D0B020365CDD 3C8DAA771DBAEF08 8242A339735991D7 F232B4F07EEDC80C 7CED1C591301823A AB306D21D9E8DA33 2EDC5277524803A5 4710C0DEA705B953 1622055CBB6CF7DE A4EE90E2749B1C4F 39059E2E9E4DC125 B6ABADEBAC24ECD8 9F04DE0C396E99A2 B4BE371EFBAEDA38 1399B596447BE2A8 883B8051BE77F9EF 004CEAE976473AA2 DDDA8B1003C55E83 7BAD35AC2F52023B 6F9363B8327DDECF 9F0DEB748C6D2F9A 5A888115FD2DAEFB A50E95512660A280 CFBD75F85A5FF01C CB926D66E75862A1 D8671DD8D78ABB1D 7860239F8B09782E CC9D316797A25E03 2545D76C9886CA1F CC247D12FE6A8107 1B4785E1B6BFB4B2 A9956F4BA283E6C0 E03809FC87EF1967 9B64FC9FDE3B1D91 5114153F453A70B1 BCA2C71AEF3E20CE 5F2822E9A25C9A93 E7119722AC439CE9 55E3B0CF33F26194 39A655AD8813F4C1 DB76C85B91F20501 E2FFDCD0D5888015 FC1ECCE3B1AA6BF2 D35E76DBBB48B881 DE9B6A3069968A87 C5EC80BE0C4721C5 3A30264ECE1A6A8F E2C71D56E71710FB BDBBFE4BF6959963 C1C0E9B922B334BE DA0166687E170487 D270A536A26BAA8A 591D631D656342B6 0CFB83EBF6AB63E8 355F7349EE62F92C C194914EEDF7CAE2 6BFF12330E72DCCC D8FCF8011ADDF763 720439628DA5E0B1 C16BA4083CA01A28 194D8FC6293F73E6 8DE1392047F5D403 4210B06AF31F04D5 7CED5A58E3AE5769 BD1C61944138AA06 6E66C800B4C6D20A 5DD7D11C0F6CAFA4 ADF81B70F9FC3322 44167886CFF0BA75 B1272AD6E5D26B66 4DA489ABA307E0F9 3ED2E922A3795B76 2F3501A697D23D08 4E77596DFACF61FD 96A5F8E98AC47AD0 7E2BB84B46D86758 C4E34083CA3AF0E6 FA171CB05B971DB6 AE8CCB9FE043DFCB 44CF8816C9D9B8C0 A255A3F245FB1F48 87C5BA7E97DCFFBD B8C77CA27DDC0702 E3DE89B3EC59567D 24584FBAD9E6D7BE 58FD73EA68BA12C5 97695E96AB04CC18 CE120D3885D7C635 9FFE8EC33B2FE0D2 C7AE6611695718C7 4A8337B9397BFDFD 2EE9F8603B1D44F9 CF04BCE0DE16DDFC 33990E55C1F93D36 AB64CF209F6DB386 D9D282AC29880F58 107BA85A7D3255EB 3598CB5BBA78715E CF91570A455E491E 25B8D8B40DD91BF5 3E52DB91286DD1D9 BAC281CD4E18B9E4 FE5FDB3AADB216B0 D1B2F15E94536048 7AB5F6C4DFEB46E9 4F58C6741E08E012 5016CE8D9403D4DE 86433EE77D036778 A959F6E01D176509 6E2ED3570F71622F EDB28ACE602F5AF8 FD043EEA34885F00 D81A33CA37F46633 AB94C713F7466BAE E05D9067B65F66B2 5FD15F38D1C75E38 236917936376620D 487F74BF8B3450CD 784132A6FBDD88E8 799BEBED86AA6338 D55F82A1DA637B75 781A281184DF08A7 E089D07BE9801CD6 64252EEF31343133 764DD4B0507D09DB E8623C3284C5D229 88D2499EB67D3DCD 00481D8E019AE287 E9C577575929F8A3 BC967639BEED7074 C62E6992B320C75C
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201308270029 (name+title). Key = MD5(password) = 514a85622e6c7611aa5fa7e71bc1dfb6, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 42e4c682-a07a-7b4d-9237-58f265c8449f
  2 4c219071-225e-6519-b348-04f5b48fad1c
  3 f0a6f6f8-ac9c-0a66-a01c-b2313aa6a4db
  4 fc3377f8-6be0-7afc-acfa-a9536920a5a4
  5 1ece3ace-bad4-6436-a07f-13882fa1ac34
  6 7483d97c-3b5c-5b60-b780-d33b4dc8cb64
  7 785d16e0-0250-36ec-8363-fb3bca690224
  8 e1082280-e490-821b-962b-a2d6d12c0e52
  9 60287379-b5d5-7d26-98f4-b1e97c3dbaf7
 10 4d85dfca-4f8b-6c8f-b6eb-eac1c4026862
 11 87f7665b-762a-377f-9717-feb2440bf08e
 12 02804017-7aae-8b71-8485-263a845a806b
 13 e359631c-e384-54bb-89fc-f2490b833af0
 14 20e8c4d7-299d-5b6d-99e2-9f91bd6230cc
 15 d50e2d88-c507-1801-9318-7eca9898b8c7
 16 86e9663c-b61f-5194-860a-f2cb8a88e325
 17 c097f311-7dfe-4fa2-bdb8-40e0b6466be3
 18 6ecf5408-8d6d-45d5-b97a-5095ffb9e48e
 19 68629270-c0b3-8df8-a3b0-c6d21c8aded5
 20 f55a0a26-b014-24a7-81df-02cd95119ccf
 21 d6825e4b-e93e-7d8a-b7e9-b475e953f60e
 22 bafdd216-4df3-6be5-9e10-021dbddba13b
 23 77d47f5e-5662-38fe-9b94-e3030b947fc0
 24 47e25527-adfe-0f9f-808a-d58f0c2a43a8
 25 354a54f2-ea98-4f84-9aae-d52c4b6ed05e
 26 42cbab66-1acf-7fa1-9667-6d1a653d18cc
 27 777061a8-ebdf-226f-9de3-c8d0bbb46704
 28 f962f824-e263-7474-934f-cc0ad6e03af5
 29 7ba77704-9ec2-0f50-8089-f56984b1f7ef
 30 0f2512db-c9bb-67ad-9497-13907acfeef5
 31 256f98f8-bf27-8dd5-9d8a-27ce97000d2d
 32 12da0f54-f507-40c4-9f98-2768900cd5b5
 33 0a64570f-5c6a-52ef-811e-0a43ae80b2c7
 34 5902cc09-4952-41af-ac7a-13252e56bf29
 35 4cdc791f-c800-473a-a10f-e438166bfd22
 36 faa669be-8bca-5912-8b18-3f23c2774a20

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 760765387638551544827630472706845445. Exactly this sequence comes out of new Random(896).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 10 of Run 51 (seed 714,271,718): new Random(714271718), 4·Next(8,16) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-13 23:35–10:35).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs