A858DE45F56D9BC9 archive

201309052159 1lsqbq

explained decrypted filler

seed 949

Metadata

Post ID
1lsqbq
Title
201309052159 → 2013-09-05 21:59 on A858's clock
Posted (UTC)
2013-09-05 17:59:53
Timezone
UTC+4 · title 21:59 against posted 17:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309052159) = 7aff0516f2839268e955728ac3fa8a76 (name+title)
GUIDs
36
Filler GUID seed
new Random(949).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
47 · predicted N = 36 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4C3283910312AF42 ADA65F5F7EB68113 FA7F23518DB7C11E DAC49C11340D639C 82B7891F45EF0080 1E3488904A55921D 6CEFF86154FB5718 A05FEA4DC057AF80 2EABD854C62CDFFA D92AE511C4684A19 D23CE2F80DAAE753 6CB1CF704591D3C6 B0E7B021E47E09D7 4D07BFC34CF2815B D442ED220D562886 BD0D42245A49195D F2EC2998040AB6E6 0269416F9F91D2A9 AB46087B4A788139 1B1A09AF447575D2 24656A74C751078B F0ECFB4F245D4ADE 2C369337330D6082 73C52D4F98C22DB6 33AAD275B023B3E2 0BE9D37C0E5CE8C6 DB7D89E101083910 502AD0C55C0EC0D6 5A5A0FC1EE9547DD 0D4081742893535D 05DB00B8BB2D7619 DD74B0FCD68829B8 86A29951BD5CA8AF 9794FD31BC868D9C 096E6FBBAAE79A64 B52BA55090A43EC5 8F453E84B38FCE5D E48FE99C39DE64D3 A572650562B947A2 F2AFCF2768E7FBAA DE4B0DFD1FF1AB8B 96A38B5FAEB5F94F AC061C20FC9A4588 786EC0CAA76EBD28 A87A0290F6A0B364 D5E504F9C15A860E 171E14A09FEE3119 A655DE1DCA9C002B 268B00F088DE8567 E82E3609F9A7FD22 ECB29AA902DE9B22 6A6BE0FC81C36157 32638EBA1F047CD7 459E1F1D69EF2DDA 3CF0851348BE57C2 EEF819867E6524F7 A0091BA7268AB669 C2BA8BE3C7F08234 9F1253931DB45981 C2F8DDD4555CCAD0 B6348D75AAE6946A 6633CA21D3B353D4 C31CB03EA61D249A AE55AE80357148B6 79F69A83CA7A597E 81BEFCD6F6D3402D EE289E17AFB84107 93F3AEDC0E561E09 1B2540DA679ED9BF 3A231BC78C1A506B 8A661D8AD14B7C76 364849740C8E3045 E71CA167CD3AA377 98D7159DFF677815 B8209C5777D5EF4F 4D954D777254B504 BCAEC958BF8F3774 D9C720463E629F1A AB3642410820742C 2D1AB119A7520FBE 7181D25CED1B4F0E CA74A1EBF52CEE9A 0A9D03E93BB9B777 837A67F20EF0E5CF 4A2608D59891ADA4 10760F0F430B653A 6DB8086B1701E8E6 8C12BE48A6D84337 1F9112C0B433D35E 768EBD8A5B48B17E 99223C39D43A97C9 D3094B01FCCE0633 F67611452FF295C4 11A8D0A1F51F77A5 BD72CCE9172A9746 5BE2970988EDE9AA 0E1A1E913688B425 A986245FDA388B6A 866031F52A940654 C594BDF879FBA27E 123BE4315C8701A7 44F762E6DE3E0464 3E066E9D78AA0917 0E137DC4036FDAA9 6C5ED1DE728C281A 5EE1B29C34BB3701 5365BFEE0227D5D8 C7DA4220598F588F A659FF8BBA7453FE 4593D679BB223C1A 9B228F92714C38AE FC53871A0CBECE2E 4E08D5BC43C6F413 43B3E0FC06BDF32B 4E9A9DDC776EB840 1B1CDEE26F1E6ABF 2129211A889C6282 1797CB5AF9CCCAF4 0475CF25648E8451 B3B6057B2185A2D3 3461599BE77934E3 6489ED1BA57088D1 2F3000BB56971633 43CA9D1C0F667E6B 4A0B3713E93A5CB6 0F66023E2DB11323 C87FEA876385FBC3 7A68AA249C8E9A05 C5B9E23D91859113 61F965BE2F845B6E 8F9B928179BAAFD0 65B345C9B8FD46BC 84B30465FC0E9BD2 B657699DFFA809CF 32388E9E7792A2FB 32944618D05AE2CF 3C2C79F56929FD60 5872ABA7149F472F E6C9B85657A5572C 63B2173E199726E7 8C3E57CC712F2361 EAFFB219D242494C 24D692E09DDD268C 55F5EAA4DA9077FB 66D5D02F0F9F730D
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309052159 (name+title). Key = MD5(password) = 7aff0516f2839268e955728ac3fa8a76, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a61568d6-21f9-4f89-badb-d8cd01450a47
  2 61d146e3-947b-29e9-8173-9ca07c32d5fe
  3 55f2050a-9d3c-0700-a369-19e763b8923d
  4 048ea10c-c3c2-14fa-8838-edbac7ff7858
  5 90af8511-d3a5-5917-b0d2-5d430fa82af9
  6 882240b3-f5e0-748a-a382-81336c0f9c84
  7 9846db03-614c-198b-b449-96d79cc6fcd8
  8 dafaf6cf-a2ec-44e6-a38f-78c70046acba
  9 d95f8327-6fce-3bf4-adc7-e1e4c0d060d8
 10 4e316a31-b24a-1eff-9a24-3418b4ae3b33
 11 a3befef9-2e04-465c-a5c7-78ccc9995fdf
 12 2589357a-0a0b-3fff-939d-4ae6a900f854
 13 0e369f1e-d512-049f-86d3-6823bcbe6891
 14 cebb6f34-4c7e-12e6-a5b3-747d23ad552e
 15 35550996-a19a-265f-ae64-c6bf7efd0f38
 16 0636af2e-6edd-6a07-970c-07fd47883136
 17 5ec5b92d-ae7b-756a-a8ea-daf5f49932f9
 18 fe5e8bec-9e55-30ec-aaa3-d450fe819dcd
 19 c8765997-c0a6-39c3-a465-fa9df3963926
 20 403e3d20-983d-66fb-bd03-f0fa5c804975
 21 2612dd2f-352d-8d82-a194-cd88c61271ac
 22 83907fec-ba9a-6c43-bb1a-9026d4c9b7ed
 23 a2362e5e-cf9a-3e9e-9e2c-4572ff17f7a8
 24 5e71c0da-2b80-5529-b84e-ab2ea00bf177
 25 05b5c309-4c34-6c4d-8898-3a93091ba9c5
 26 73956a0e-907a-83e5-b5ea-11cd7201350e
 27 77f4b4df-6784-7094-bb9d-f2b3402e7bae
 28 bb7688b2-646c-69e5-9749-776d2c53621e
 29 55324f21-7ff8-6944-85eb-34d9404a1ba8
 30 0f4d6046-9279-3a38-b344-f44a2d8b4c1f
 31 54a88a9c-98a9-4020-a431-29a886dff033
 32 d570977b-f49f-3f87-92c0-3b98767198e1
 33 d7ea1b57-f3da-815a-b6f1-8d98c38d57e3
 34 311e6bfe-3a1d-7a9f-b75f-fd5dc243cbd7
 35 fc7cf272-88b7-0bfa-a87b-5f877fc00155
 36 e004478f-f162-83be-a8f0-78fab692c0e4

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 420157143143012673368635687663438708. Exactly this sequence comes out of new Random(949).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 47 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs