A858DE45F56D9BC9 archive

201309080959 1lyigs

explained decrypted filler

seed 257

Metadata

Post ID
1lyigs
Title
201309080959 → 2013-09-08 09:59 on A858's clock
Posted (UTC)
2013-09-08 05:59:50
Timezone
UTC+4 · title 09:59 against posted 05:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309080959) = 8ffc5eb39760cc5f730b757d46bf6167 (name+title)
GUIDs
36
Filler GUID seed
new Random(257).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
67 · predicted N = 36 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B779D292AD4E0614 034D7240EB7AF276 E8DE096E56826121 6250D7C31329FBF8 3B3D1176F3E7EA0E DD2EAED4D3FFCAAF B0A6330589649E5E D7A6E20C1650D37B 79CCFC2874247ABB 2BCBE876C64BE259 04FD12E7E7529C3E AC030FBD6C336DF8 00AE3AE93826A064 39683CF9E48CE1EC DCE3E8FADC5C59CA 8B0366A6123C281B 3FCF94CFE8C64F48 82B9EA0EC11E9553 D7611F93DFE5B10D DC5292F59F52161C 1E8F8C0F0BC6877C 298D36EAE302BF3D 77C381DFC8A90A81 CCBE4EF108D6F82D A06525E171EF78CE ED59250E97D99328 9A9CA3596EAFE9EB 18560068AC5C8A12 A19BF22EB4DFD96A 41D0A767E10FE2C3 1A53776A7E7E9095 94F0B9B744C1013D EE33A438EC74FD29 2FF6CF266A237EDC E146816752D31C77 B29CA588E66E5F25 FCC346C6F4AA9193 79E0A2DAC0BCC9B2 32D3901D44F62D20 E87F8307F20E7715 0E70B162048D1595 2EB5CABEC57E0B54 8BA13DD75AF9F37F 8B4AC61B129A3CBD 5F67F38175EFD875 D0134A932FBB1AFF ECE2A266B09AD61C F79B4625312F1CD7 3F0AF1CC73702181 481B91023B7C78D6 43B1B9D5D94F03EC F19D65ED3A11D2E3 7A86CD5CCFD72747 3E5787DA2B60CC27 BF1C28F7E7580127 4EF12A87C2A48717 ABED7B8DF9625FD4 3D20377C95139FAC AAF34AC32A5C1304 893A0451F4A67319 F25C74356960015F 36E51DD628BDAC70 0405696B73D2C1D8 33C9FE9DF2534F55 5AAA17D9E100A47A 61B06A110F1DA155 37FD876F1F95A3FE 012806389A4DD048 E5A48C3E5A9478BD 3EA8C3310B408BE6 33AAEE7E322A2336 CBBAD46270235FB6 5A059CED9275E0F8 5ED735A67827B9D8 A763B9AFB52AF072 7C1F50452FFB17DD 528D19435E0B9C95 2AA880B6CF7B6CB9 53C2B938D6705E57 41B2A37F35F4168C 45AD439F13125EEF 61BD6475C374F694 E039F1C58E21E643 B72D18E35307DD65 9CC2420C79C490E2 DDB686F34D30CECA 10904697BCF750DC FE33774F340ACED9 FD000AE7FAF831CD 83CCCA8D64947B83 B70C767D97B506FB 28AC8C2FF1E5C499 2EB2774367D345A2 C1C0D177D60EB799 8780EAFFA3E2919D A903853B711F2088 3406FB03FCFBB37B 56364607147887FF C061AB9E56528C74 FA9C67E5844DA607 01CBB27562412635 7F5111C6D0FB7A38 0847D71DE0507BDD 8672AE43DBC95987 21902D20110CD18D 2E071FC938611DA3 933E53E8D680A911 BFCFB1701205D0AD 730B61528251E408 54DB67C6A6CF8833 3E62C5482B4D3AA1 69599EB62C916E16 BB565197638BC317 6C29F77B28ED075F 0FB4C0A667605032 8EA1284D515D20B8 6A5511C6C7986FB0 4DED3E2AE401F8D6 EC08ED8F396CBF5C C6EAF30FAA9D6106 228E7FEB98A4B6D9 DCF67A3838F52238 B9EBAE21E76353AD 1CD43328B4A81535 A1C11A77BB2DD528 7AEC1289A3483E0C 16B41B29E9E7050E BCD7E46D2A96955D C5CDE62C56167388 5019365F07C0A79E 87B62E98FB2EB9DD 43393EAD3DB9B473 B62A7BF3C14A8094 42B505E7B1DACB36 EB07B08F968831A9 ABFA0FC916B83D58 93831C75CF2CADEE 86FC3A64C6F820AE C7D3D668DBA811E4 0A4702128AEDBFEA DD3FFBC44AB43D95 2C498EC2C71FC645 DA72565336F8DF53 21671E21CEE539D7 7BD656CE487967C4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309080959 (name+title). Key = MD5(password) = 8ffc5eb39760cc5f730b757d46bf6167, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 67fa91a9-334f-8cd8-9942-e12d69e8712a
  2 e0cfa05d-724e-2298-8527-c54d8f99833e
  3 e24da3bf-e9aa-3b78-8740-7855cbbd4f29
  4 0aae2a46-8790-354d-abd4-be9da5a62837
  5 9d2871cd-93f6-2c30-980f-d11b911dedb9
  6 624a7979-c7b8-1b82-8ea4-1eac428dd3f8
  7 7fb06f48-d31b-0de4-9295-46d265bbfc48
  8 cba35b9f-7e44-39a6-b257-b93576ef759e
  9 7556c4da-93c5-6e2c-8080-5afb83ab1a50
 10 6baedc4b-b037-01ec-ad49-2d83b923cb98
 11 757b1b8a-11e2-5bfb-b42e-003598d7ce52
 12 0c0861e2-21d6-0294-b818-261968041d88
 13 006f2c02-a773-2afc-addf-14037a70fbc2
 14 4f4c328a-15a7-14bc-afd4-4f615ec8d60d
 15 9700efaf-d44f-706f-a9a5-aea1aa19c44c
 16 59f90c9d-26a9-47cb-8eb3-08c6abd2892e
 17 1e34564b-cab0-858f-b26d-fff72be7dc76
 18 dba746f5-504b-3e41-8000-668123798854
 19 6b0cf172-71ec-52e4-b979-21ae3aa8d663
 20 6fae950f-7f0b-792f-beab-3aaa8dbc52ed
 21 bc7d259f-e996-8bce-8bab-ddc53780113d
 22 8925c6dc-e3cd-895e-865a-5d24ece11b7f
 23 f4f20a18-0b4e-3312-a612-8cd4f02a7575
 24 6571e4ce-a0e6-7708-90a6-906103d0cd41
 25 fa0e005c-8750-78f7-b7c3-f164a0e38a37
 26 550e4ce3-0485-7a00-9131-746fcd2b106f
 27 94071828-ba4a-8e74-8a2d-7e8235a343b5
 28 ff35bb54-0bbe-8279-a814-91bfe123af30
 29 0406424f-d6e3-4634-ba08-ac4190ca29e5
 30 a04488f1-ef8e-0785-9332-5356d48935b3
 31 8a533270-36e4-0c0e-8c37-85e2558f4e43
 32 f6aedaae-844b-1d3d-8d9f-30bf0d34d7ae
 33 cd218914-9c30-50c2-9f22-9c23dbc41a2a
 34 30afcf02-5ce2-3e14-a08a-e639301818fd
 35 e45a25e3-7dc3-3789-900a-594a4813469c
 36 84d36c36-2f28-80f1-ab08-eb6df67e9d73

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 823321036050217483578837778840015338. Exactly this sequence comes out of new Random(257).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 67 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs