A858DE45F56D9BC9 archive

201309060059 1lt52u

explained decrypted filler

seed 857

Metadata

Post ID
1lt52u
Title
201309060059 → 2013-09-06 00:59 on A858's clock
Posted (UTC)
2013-09-05 20:59:53
Timezone
UTC+4 · title 00:59 against posted 20:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309060059) = 3b4c45e09c93537e7a83fbe602f83555 (name+title)
GUIDs
36
Filler GUID seed
new Random(857).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
48 · predicted N = 36 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

543EE7E01E6B4245 2496335DAAB781BF 346DA806AB8F25C7 6F5E454D29044A9F 45DB1B5A3AE97D17 7B7958D40E679D10 090104C7D86B4F38 D3106EDF1B4D6BE4 93689E5A47A9B1B8 A906AADA467CE142 EF675BA4DA7D9483 B0E807132EF8C854 7AD9585FA64B556A B93615426954FD80 E68DE81AEAF0AF7B 443A69E84667CEE9 1A03D15A97F2A137 F8B3725AC6F971B0 5B06C1C2B3AE9F44 2BD6287D8403448A 07AD2B28F66660D0 B26472A77298CF3B 5585CD407311C8A5 F9F2F9E688D9D28E 8530FA073D6E875E 769747BE2C1DB499 7DC11FDED4F8CBF7 0FAC988E3E50F0B2 FEB7128BBC9582E3 6502623C188489F0 DDBD1B8D066687C2 E5BBAF40ED37AE4F 0C2DC06305CD549C E135EBD1C949A644 05478CACA1009674 8A30754D777D9CBB 86AE13111078809D E6F1B3BBC19F7F4A 5A2F8F55751D5D5F 7D23026E2E95BEBA 4F4F78DB75FEB8FD 4412B911F1F3E7E9 015EFE01C8DA6A7A A85E048A89FC7EAD A3C85DD874CF1D5B 7A352102A707C62B 1C03A9F016E5CCAD 936694A17C0B1CBD 1B71FE39519B0B67 39B776635A3FC738 EB9D2B36AEC4989D 848137EEE5C7827A D9D6E7DE6E61F223 77EE6E1752471613 B00C0B3C50B8F033 B51BD6C6A3635C4C ED72D1923B95DCB2 AD28ED5B66389D48 5947AA63C63993F8 20006C82E9E60739 2A18357915B97641 5BC5903E747F0A24 4C5D7A1B103BE2DA 79810C60FACA2B82 77DD3229BE768756 024B2191B2B0686C E663A93E76BF3A8B 513CC4AF74279640 4040429F5E408F25 F9EFB4F61F106ADD E1F92EE84363189A 6075EB7E70E5816D 17B62C2F460B1B09 A8A7B0A3988F79D0 DE4AE98C5342E0F2 4409C751404303B0 2632116A28F63982 9C1E152E8C512ED1 886B9A1079DD5304 9C7C271A60DC354D F6369A618B54F76C 13BB7611F52C8B18 BDD6AE4D901E30BF ED04DE665CD1A556 F780439A8B0FF660 2FAE4AC6519C28AC E66AFA3BDED7DB84 5552FF7544261FC2 6B51CB675E49CE10 2DB4FD87FD034B52 2EB899A241C1B314 A8E8E952C8D7BD95 1A8044E7D1A4F835 789AA9B24284ADF2 266133A27A04F5A7 AE0192BA13282EB9 3B84E82702F58FBE DD53085FF0AF3329 61E0B10F8B81A3F5 1BFE67FAC7B36BEF 95A592B28C45B948 22B80412655FFB45 F30480E53F1B179C C65BBCF6F0AF5BB7 6876FA660D683CDE 9BCD3902C40353F7 F47DA3B63A5E11CA 0D92E6F5650D5F32 7EA29C9AD391174A A0F2DA1D4235AAC4 A24F9FFC61884CC6 677171C11095D36D 832829CE46BC36D7 DC5EF3CB2511568D B8A89F858CD3D027 3D6A89851A32E77C EEF5EAB16D773DA3 BD9FBCAD89EFFEB4 95D72B29BFD23686 D8D9F657D3B1ECCE 7FC3C2E681C787E5 09D47D7E8EAEF135 16EC6D555E82CD94 1F1BF9AB5B3F2FEF AFB4A90A83270593 51213EE800E00D00 64D00452FCE4A351 D9F5B5E83DC84A5A 137E0915903D131C B65830C757EF9224 88BF1BFEE84E1E07 CD28203774EE12FB 3E33828D45465BD4 D2DC7DF1F7CECB3A B9668EB37A95BB3D FFCE8309E91CC6B3 3229AB102F3A7DEE D073C56A2286D364 47FB41817D3ECAED 9D12047D7D0A18F0 AF61CD4663D1BC4D 3C5C0B5C05A5FE8D FF100A367063D1CC C2BC243B8AB6A013 C7ED3B42A4182868
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309060059 (name+title). Key = MD5(password) = 3b4c45e09c93537e7a83fbe602f83555, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 86aaca59-5633-4793-ab68-8d858b2ad7f0
  2 fc57b3fe-9eb3-2bbc-85c2-58d6ae592712
  3 5337bd59-9521-7af9-b92d-823527376427
  4 23eaf336-2197-4cd5-a34a-e32fdaf78ab0
  5 30bd7208-0af0-1022-b019-795b1e7d470e
  6 1b24304c-afca-4699-b003-16948d93c01c
  7 07cf762d-9584-82ff-81c0-a6574f473292
  8 ad41034b-2c49-3b44-9893-a2a576eaa407
  9 0080ca5d-6ef3-0d1f-8a0a-914679ab787a
 10 97c71025-7fae-2ffd-b7ae-b202fd87cc21
 11 2962e504-c813-6d46-a491-a8a6f3cc3e31
 12 4b14fe1b-c205-48bb-a4dc-21f44cd1d6fc
 13 072b7387-59e3-7f3b-a341-6300ac1f59a9
 14 1b565db4-17bb-297e-99d5-9db388132bac
 15 a9ca6333-c654-7bae-875d-f2ce592aa8b4
 16 6cdab988-fbde-2c26-ad6a-c638061e7ad0
 17 a9b39c48-2609-0ae5-8b09-39e5fcad4c55
 18 d8fa3357-b5aa-3d6c-83c9-7e25c6a71c0d
 19 a615fe23-849d-7fd1-8fa7-65df5bae70d7
 20 e8e46a73-3267-110f-a458-e3df96148385
 21 ad16fea5-a84a-692c-b40f-54a4416a858b
 22 2ed6e6da-e127-0f65-bb78-a3f88d72fe27
 23 6d2e839b-6c99-7b29-ae83-6da53dd36dc3
 24 42cf9e91-0ba9-3601-9686-7210e68086d1
 25 dc276fb9-98f4-65ad-8ffb-6f388a9f6e38
 26 4e4865fb-76af-62da-8a1f-7dfc37dad4f9
 27 4a207078-11c8-6b2d-a08a-779f440895d5
 28 feae7f1c-0fcf-67bc-80ed-580d885b558b
 29 e5269154-c882-2c1e-af8d-4eb148cfde57
 30 f1fd3e5c-73e7-22b4-9b2c-d055fbc0c490
 31 5c113edf-da37-5515-ac53-ce559c742a6b
 32 3a48c11e-f890-1f35-9042-08cbfc3490cd
 33 9dc7772f-787a-8d12-9041-647c6e466431
 34 11b49d54-e95a-496d-bc76-ced8dd1fa4d1
 35 0c80b4c5-20d6-740f-bac0-e5a4c2b28b8a
 36 70218b15-8953-8ae9-908d-c21b941be449

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 427414830264727203716073666622518478. Exactly this sequence comes out of new Random(857).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 48 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs