A858DE45F56D9BC9 archive

201308311559 1lghil

explained decrypted filler

seed 518

Metadata

Post ID
1lghil
Title
201308311559 → 2013-08-31 15:59 on A858's clock
Posted (UTC)
2013-08-31 11:59:59
Timezone
UTC+4 · title 15:59 against posted 11:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201308311559) = b74155df8d8ab27a99681d69ed41e550 (name+title)
GUIDs
36
Filler GUID seed
new Random(518).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
5 · predicted N = 36 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4581879492438103 0B52F7C3628AC71A A70E4C90E2DE5604 EA513C8BC535AB8A 77A738E24BC60BB3 E6B06647C396343D 3717AD6C7FAE3AC7 E1116E3E922F344F 69EF9559026E3B5C 767D830532F4265F 68905ED9899CD75A D041A40D5D71B9A3 040D9C1AFFA16307 4EB930560F3D8847 6E4F0E2DFAEA2B5B 74C1B30A45B88A0B 2B89ACF59EFA80E4 B3E207C69373B4FC F723DFC1B1FDBB65 CC54128B7B1BEA91 2F5A19DE50196240 071392CD5A1F1EE1 CA3FAA4EA496F2BD C2D97C8A033DCB04 A81D3D34BF4F428A 95BBB6B5B853573C BEEE2AD20624F0B1 35239F1FF599FAD1 723E061F88D2DC2B 8CACBC88FF132052 9B4B0DCFA25D9342 BE0D34ECD000D766 1349EEB05C3A29C7 DEE38AAD91911809 22DE8E2DE6110F84 FFD781FABE687735 FD248EB69C930AD4 390FB0865CDB7EB5 152EE43C79A24F35 40734859B214D49D EE2BD73B811EF1FB F2B91D5FC42B8A1C C775859D4ADFC7B6 190F4614F08E9417 D1D56BBE7DF1178E E906A8B98C50DBB4 16026BC50302738E B3F06E9C3FA7A5B8 88C6D5F5190DC120 2FBD849556EF664F 57518B509F056BFF E28E8351E2C78213 2BEEDB87D5F71E4D 7E96236A688E1FF8 4E47FB8D26DD00B8 D925C6EAFE33F2BB 6DA322093BDA307F 6D24733A23763484 BB1ACB2B65C09CE0 4D51AEBF10A0F263 221FFEF4C8E08858 A3BC50DFA2076C7F 7DC97292C1BCBFBF F67431A26D54F528 073B0057C714DC96 C3E542EC6F87A9A6 8C5733DF9375868B C4DDCD396F81B900 8B2A532325D5FCF7 5DAABF2A233BA1E8 391EB0602A83774D D4BC1DE679179E92 6BEA24B59262AE90 28C947CBED2E4F56 30D39F45F97B2092 D4BA961435686283 32CC3149B61C1B2D 41200284B6F014EC 10AFEF1098D1167F 4A197D3F85A985E9 537A6B69FB888A53 BC2192EE92E336BE 47F1ACB58F704C1C 9A14112ADB3A6B34 9BD474C6BF1B3E93 4DCA583D0CE2F5DE AF85649B72CDCDEC 0D94D48DD59D6AC1 1D57A2DC24D7A2FB E96F1BE6EBB55B2C 8679912C9C62D7FF 8CF45D282BBAF404 5F1D4EACEC35212D 12793B22F8C0B61F 6CB9960A8256D084 A1F434731BF756E4 83D05625107BEC53 A08132DDCE4F81AF CCFBC7826F646114 F21670A05225D7F2 A7AD9A202C6A7A49 65B9D60E1E5E5CDE 3EE4A7F567F7D724 972C77A80FA53B4D 6BFA1D0459DA241F 8493E0120CCF1FA9 5FD4EBF93BC93F52 4D073DF7B3E0D43D DA765BE40A0A233B B66AE544FEA011E9 4AB5296BFF973934 C1C9CD357599251E BA2060E63346CD85 44FBA343CCD90E66 24C9832D468EB682 0C1539BE485C9F12 FF9ACA8CA6643F84 98BB4926F306C264 730A272232D9A469 DB624DDC637D696F E6AE025C21C69655 26C7D963178CE09B 8C26CC2BC121746D 4E71E811DBBCDC1E C585FC581AFFC0AA 071347C8B40725A9 1EE3CF70880A0D7B B8B59933AFC11DE1 FF72E8813DBC8306 E8C69FC0D050DA35 D5FAF7892EA61F70 789D187F6FE150F8 D673F4785E3EEB58 CED0E98F58700DEC 53FF166744C0356A E05F443978E2BDAB FFC0AC2DC1049F4A 710FE1FE60C6E075 9ECDEB86A50EEA24 22B04E5A323C59D6 68499E62FD2CEB13 8494FD67A196FE6A 857DF7BA9E1E2741 DC5A2BD3B3404210 61F8A45DC9BADA68
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201308311559 (name+title). Key = MD5(password) = b74155df8d8ab27a99681d69ed41e550, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0be7e465-e746-3f35-9584-75ae85131cba
  2 62a6d984-2059-79d2-af5c-9127d93f2163
  3 211f1cbe-651e-731d-b802-662233e7c7c6
  4 d51dc2ae-60fe-196b-8428-0823ccc1bc74
  5 63acf69e-7ee8-08f8-b745-70fa18061991
  6 d4355f5f-2ec0-2974-a678-7670eea66c5c
  7 ba20344a-e0f0-820e-b8d6-b435404aedbf
  8 887f6ba4-4c50-2ec4-ab86-87c32baa3295
  9 e7265b3f-bbd7-04c6-97bb-16874fea2a8c
 10 3d680b66-b30f-2f05-a999-5e0e3154eb1f
 11 47a976e8-2dcd-82ac-957d-17fa8f48de83
 12 fa86d9f1-f3d3-72d1-888b-8a2b45c04ff7
 13 01edb333-43f8-6ea3-9df1-aa550a0a111a
 14 de476f56-54da-8204-950f-fc4c1d654742
 15 9000bac8-90ad-50bc-a967-43b1c7f17f20
 16 2013defd-ea95-411a-9306-c42075d25cdf
 17 8f3bca45-daf9-5b8d-b549-949a4994faa0
 18 8f16e723-6493-1221-925e-1764a5557148
 19 6724c574-ecae-60f1-b0b7-7112cd97b1fd
 20 7b7a9230-37d9-7abf-8c1e-c3fe29aeef8c
 21 843af483-649b-59bb-86d3-ff220a5aaf6f
 22 bea6bf3b-f549-84e3-877b-2fcb8630a5cb
 23 9f73dd47-b2a6-4964-bca0-dbebc5a9b413
 24 be0c229a-9c65-8778-aa50-e8fa14923503
 25 478f0a30-8724-41a1-b350-abb6462ddfa8
 26 063f6d73-5e62-621a-a624-ed8cfaf72e3c
 27 4ff4bba7-5cb7-2155-b18c-8616440b0fe4
 28 17e2c48f-4937-5117-9183-bb683cca9032
 29 fcab00ac-07b3-5fd3-b92b-f5090b488f07
 30 44398e6e-2664-2107-a23f-20b634f8b7d6
 31 4a11a099-3c24-36b7-b572-32634d88f0e7
 32 a4a5a931-6222-8e35-ab70-51c5dee5afbe
 33 a9284f8f-8e02-59a0-900b-0149daba8247
 34 549e854e-07d1-89f4-8c00-0a0f410de735
 35 d504631b-ba57-4bca-88a2-a661f045dd1f
 36 98969907-0c01-11d4-8f53-7063a4f955a8

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 377102820287685451675848462552385841. Exactly this sequence comes out of new Random(518).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 5 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs