A858DE45F56D9BC9 archive

201309022159 1ll81a

explained decrypted filler

seed 792

Metadata

Post ID
1ll81a
Title
201309022159 → 2013-09-02 21:59 on A858's clock
Posted (UTC)
2013-09-02 17:59:57
Timezone
UTC+4 · title 21:59 against posted 17:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309022159) = 7de2aad036c167b5a4f4383ca667da81 (name+title)
GUIDs
36
Filler GUID seed
new Random(792).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
23 · predicted N = 36 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FC037FCEA2FFD02E 84922E22C070EAEF 7B912A604D44466B 672F3D5BD0CBCC99 92C7101241B31924 3B056E563B944208 9686CDA8B8EF1972 3F1950736F45C530 CE399997BD1F94C9 32874DCAAD404D76 3F323B85FE767947 B7B21E82E8C18E5E 56F0623820141055 C2B3B76CA83F9469 050B17344E488727 354BFF8DED836BE4 A5FC35069088DD92 B1B02AF29BA87C82 585B371D38A8D323 1C12D2BD0F913A62 FBD5C4C6429CA5D3 5FE7A8A8CAB3D2C2 429540258028ED28 D41E710813BA3411 B4D2721AC2C7AA52 BF6175E09F02AEC3 54755A10AF6EEAD2 40381C5B286F8F31 8564ABB935A7534B 8D52CACC3AB3223E 3E66076128757A97 2F43F2D088D56D6F BB46E98946A62E45 BA87E40AC2927A58 292D5D8AA0E88059 B5E270630152602B C756B845F9B9FF87 7776B20273E1CD7D 5FFE8EA5B6C86AE5 BCFE4D961FA0E21C C43B9B13EBE95D53 91894CDA01938E82 316A66B05A2124C5 8408F6D32FA36847 05E7555EF68A32F7 128A83F6DCB7BC28 43C95D94C0D6308F BCDB97B046D78624 A2EC531441C42F9C BF7C7C79376164DD 0803E9123CA9ED1B C01DE1C7F78B5A85 224CB31C79A973C9 39EDA628B65937DC BCF193BE34073F21 4ECA6EDDA73DE05B 2750606A48859418 30363E1710009BB4 0C1CF848A4C78C8C A8B5357C56679DD8 CB855FB73A33F031 669088C3C414F459 BBC5FDE2B439136B 2714DB6F28FACF50 63E2E4B1BDBEC39F CDEAD4D0932AD15F 21AE08DA0F1987D8 F7B35F24DC8FC943 1D92CDB50EEB33D9 AC59619A18D99EDD 46B4064D3FDF26C3 0A7C4455476A9F2E 37E3D0DBD08FE8F7 35D4CC074D9F9F8C 8EE4E20736E17972 4AF6A61C0A93AF42 53DBE10323154335 4810D07E40F86DAE D79A9CE52DE5A594 993D1A5E8BA164E7 EABDA0EBFE2B1D19 159B9758088BC4FA 251AFE9E44C57290 193C756481855DEB 9FD52C44860092C8 476E5F8D240AF111 11EC8087A341FA15 E7B5FF05AD13EFB9 A5D4C2B6A333C0B2 B393929843AFBDCE F12F7ECF55102964 79E4BB009363AD17 F45EB259D2ABF764 98FE687C952EE2BF E40D93AD25F1C90A 2D860047B7DEF736 7E7BCA624BFB2626 7F0B490AB328A797 C5AFBFF763CCC9E1 81E933CEC37700B6 56524D4B1F071BCD 2B7BBA5AC3FA4863 C2102343386C4707 D7C8CBA83A65A6E3 BDC7ECCEE4FE76FE 9BF0D69312CD9D90 AF5A03A8B5BC008D BFA5A675CD0AC914 63E7F7D8C1741E89 7C561DB799C43F4C 0FA6FB9ACBF99E55 263F374666CCD059 51F8E27A4E80B3E7 DEEDB9925A08C32D C740FEA17DFBAD03 6B6B874917AC28ED 1C1A947FBE91FEDE F31D6D292E756A48 B08526F5FDD2ED56 3A5EB6DD705A8FF6 5049BD1E3D16271C BA6FEE7C2E66C16C FED4251A027F09B1 205DDE45C3AC3250 69EE8B85E6FA5AEA A240A2D06AD376B4 A9EFDAEFB0528D41 55C088FE067A0E7D 69E1196CA2F30CAC 33B1F60595039B7A 9EF30F66DAA2EC3F A138346284D49DBC 9B63918D231EC66A 47A76F522477F846 D822BFB9BCD86F54 857AC37F0F53A4D8 C13C570314360194 0ACE33F2CB2BC4BE 35E6140424EDC399 24528247EAE4512F 25DDCDB3C0F1AA45 61DAE7DE46338D48 9A52411CF092911E CEDD251B2F03B851 4998D0D280CEAFFE
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309022159 (name+title). Key = MD5(password) = 7de2aad036c167b5a4f4383ca667da81, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 150f82f9-430d-4039-a1ba-c9272d259336
  2 dd075ff6-06e6-1809-b178-359702ea3559
  3 e12c353a-0857-3b90-8c6b-90e74cae4231
  4 2446d659-270f-56bf-99b3-74ed77f96ea3
  5 6708675c-d250-74ee-b6f9-3f971a48a512
  6 21c754d0-11b1-6753-b652-1bf2ae9bb677
  7 050604b4-c649-6f43-80d5-75b44e02e379
  8 b95487e3-c9a4-60b2-8c29-bef7d6955c7c
  9 ca94eff6-4094-8287-b576-18f7c676b4c9
 10 339af3bb-8ed4-250d-a800-dd6a6ee237af
 11 7c154958-dc9e-7dd5-8107-c9796d9dbe44
 12 907b956c-e6ff-7b20-a5a8-d8d0275511e4
 13 324467a8-b273-096a-9a91-c15192c0bbd1
 14 1e8df0ec-efcc-43a4-a25a-5bd0b34ec901
 15 17944c09-661a-301d-9d55-a5f9a7ac7f26
 16 a4c576db-3fca-567c-adee-9e40f427fc86
 17 aa8c521b-864d-7c83-8012-26bee32547d9
 18 3b7da095-20f5-08d2-8acf-c1b6c7dc0538
 19 792dcecf-1b38-129c-99c6-810086da7943
 20 a84ae328-1994-855b-bace-0db4855010b5
 21 bfe0a1a5-b9a0-0d89-896c-0843f9fcdd37
 22 caa4bed0-dc03-1d0b-8aaa-7f367d59892f
 23 95c23e2e-4045-7663-be5b-67175637389a
 24 ab9dc492-7ca9-6cd0-bee1-b4469acf92f4
 25 4aa22dd7-ae88-2411-a387-998a07969776
 26 510f59ee-2474-8e93-bbc0-f8c66136e6e0
 27 36f060c1-fadb-7313-a261-9ccc63ea2c41
 28 890414a0-aaab-36dc-ae33-225e4ea3c225
 29 4be79cb6-69de-2f5d-90a5-094c0f7a5db3
 30 66f8eeaf-9da8-842e-9615-ad8a2b73cc13
 31 da066609-28c2-56c6-bc3f-1af3285c46a1
 32 3371a1c5-c3ee-0bad-8a43-ea3056c1b074
 33 259e5916-2c10-7928-a743-7d52d0b2d9a2
 34 57ab2d9f-4430-767d-8d75-16f63fcab561
 35 fe078d46-f58c-191e-ab41-c8f78848a0c1
 36 0016fde8-6704-0d58-a2dc-e89e9dccaad6

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 413576668277043570180176287328507710. Exactly this sequence comes out of new Random(792).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 23 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs