A858DE45F56D9BC9 archive

201309090059 1lzp0q

explained decrypted filler

seed 631

Metadata

Post ID
1lzp0q
Title
201309090059 → 2013-09-09 00:59 on A858's clock
Posted (UTC)
2013-09-08 20:59:49
Timezone
UTC+4 · title 00:59 against posted 20:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309090059) = f95b5c2b316b1a2f5fe09dc5b83cdb39 (name+title)
GUIDs
36
Filler GUID seed
new Random(631).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
72 · predicted N = 36 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E3A8667825C4AAAD 7CA57F03931CB077 F32C75DF2D0CF7F8 F1F11892DE892539 80E0DE3A57DB9AF2 CB346CB70A1E8C04 2B097F443E511AA0 81EB29D05FBE4A74 F28C905B461A1A15 9D839796A9BA8225 0145045355E6C6C6 0FBCA75E420F01CB E59FEB5C88365751 72563480A0662F8A 75B95E71E313A338 67DAF3A7CFE9FC4F BA4E362356DC328E CD279AE497BBD193 1E794F6DCF7CACF0 91388DE4DC88DFC3 BDF7B19E76F22755 BE886CA62C7D21A4 C669AA2382FDF129 A825A7317D2F3049 29897550C3D185E6 3295FAC322A5D4A1 8A4A231964C271B5 7EAA2B3A7FB9ADF4 5921C48818DF3A25 8AFA5AF969E68018 54D08814466A68DC 360F8B23FC4C3376 E866A9B97240862C 15985810296E5EF6 BF59E7ECDC1D2C0A 1EA1D428D0BDF924 FB2CA458F8663001 288B76C88CDD6C4D E0A10F4D7AF0CAC9 0A9132CCA73F05E9 FBF07D5E58C11EBE 92CBB3AF6FCFCA41 A7589E0883AD202F A031B41E0327D7B1 4EF6893636B51554 A72DF4231B2A9DC5 E6F377ACB40E5BB2 D6CEBD248A429102 C7AAECD68E8EDE36 655D55618D3ED17A 32F5238E2E4BCE44 1C3370E4182DBAFF 37AE3D78BAA81F35 88141412B4E24509 2117939C5FBCF9E8 1B91EEBA7B562102 4055D7C99E803C0E 44D778301870B329 E24A577F13385CA9 BA0A18AF059670A0 C067A9F1D9B70FFD 2231B8C18955F834 858237DFFEA9628F 92E772D3E421CCC5 22FD1C519B654714 A95B542A8E991346 A02219C080F563A1 4CA208DC14BAAAC0 AEEF987FDD472D9A DA4A9015A950A19F 03FB0B80F732D6B0 61FA9C187F3F14C1 C35ED6C21FA843F9 187727A7CB45F723 6024EE493A30836D FC439A59BED71BEC 63161AB7B86940C6 FBB37DA8D0FA9115 AB40446E81490290 10D02D62279C795A 168F60BAE241F2A2 6B0AAD0A58059593 3B1354C14265EA01 2D1ABB211E76BB80 884EC2DDEB4EF7C7 41367B57FB3C3219 F0435BC4C7A62BE9 CC612A3E5082FCF0 1D0A8FF2ADE5D26C 97FAE882CA6002C3 1F442E0FA3CC6F88 A18EE77F0BE280AB C1E7E79E9D64C789 A50746AB08A3F06F D5DA4D2687A98490 CA1E1C588A7AB06E ABA271933DC8C5C6 58150C8366BFED3A BA9DEE270856DD81 EDC4FD5BE902256D 7885A05D32D07CA3 30F0690957BEFAE5 40D47A94A0EE8C98 53ACF93DB6A7E020 21A8A20C9EF28D17 BAC14B6F30778157 7BD6B3C899A245D4 11C125D959E82672 4EFCF0277A136B38 D30658CC1BFBF682 CE0FA5CF56FB8A61 388BA528AEF8642C 3498A77F956A8FB8 D1336F07DD061455 6DEF966270C3F80D F516A9AC62EAD8D1 003EC835DB377F7A A4A0AE703A4A8B62 B5065412C67884D4 7D97863134026D6E 63A13796A7C40B18 A299C79D0AD46259 3C7F248D8E99B36A 5EF945E572E8CAC1 30380A61FB2A8FCF 4DB93936A21B2BF9 FE74B4461A3AF688 E6D589D14CDE24C6 B472A45BE4AC4418 CA865096596F91B3 000257F6E3BB7781 C850FBF6C37A5ACD 8CA79ECE4742C45B 19184CD892B5AA57 288736094FF43596 0083987CD7BEDD9B BA3484F3E5096270 E30F8574F7E199ED 4B09184D20E20F56 216EAB281F7E85FD B813945E73AE9DC5 728C738D36C23F40 9B44CF8F137D3275 D2212C83BB6593A8 72864019BB852043
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309090059 (name+title). Key = MD5(password) = f95b5c2b316b1a2f5fe09dc5b83cdb39, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 578354d2-8e75-3d63-b865-4c9885c78738
  2 d23fb718-4951-8e48-a71e-ffbc5804b8d2
  3 3a9036c2-932c-7831-a9dc-5a6d0384cce1
  4 ee19e5b9-2cae-20ee-82c2-f82b5fc8965b
  5 fa330ccf-a938-0161-864d-4965a6a596d7
  6 be2e2b8c-daa4-898e-bfb3-b506724d5f70
  7 f63544d0-82bd-5b4f-9175-d461ddf32c96
  8 3bacaf9d-ffb6-0ad2-b8b7-b3e7d0d9adfe
  9 fd377255-f843-0f3a-96cd-eaa6ccfa5453
 10 22b99296-8abb-8abd-b16c-669f8119eae3
 11 783321f8-f63b-1859-8299-14986eb6ac83
 12 bc142240-7329-0528-8011-def31b2712d7
 13 25f9c22b-53c6-3999-8da3-ee0489a25087
 14 66a6592c-c286-6ca2-b1a8-845ee2383820
 15 294d77d1-8aa0-5132-a19a-dba3320b7b32
 16 6ab7595b-7307-046c-9dd0-3b6720faa876
 17 4991d805-add7-0ebb-b50a-d82baf47fba2
 18 2db20296-ed94-10dd-9399-3931559d0c12
 19 ef691e67-c2cc-63d5-8277-eabdf5ffb8c5
 20 b21bd55e-4166-569e-a6a1-73ddc246d844
 21 069207c3-0d5d-5b49-9ee9-94026fe04c63
 22 97b49a9c-0481-5421-8c96-1b11f3f7a1b2
 23 2ea07357-9631-52c7-a67e-8ed25914eae9
 24 52108a74-c233-46a1-95fc-e8ef30a4ba81
 25 55d5a7cd-0eb7-4430-b1ae-12ad30109269
 26 0ec548fd-d087-3d23-be1a-159c4feb1794
 27 6cccecfe-0658-4134-aba4-1a0b59ace8cb
 28 bcdb3354-b159-5684-b9c9-99cc75648a10
 29 240eda5d-5112-7699-8b41-3558de9759e3
 30 63d21ef8-6ecd-26cd-853c-0bf713f1af80
 31 cef5211c-53cc-199e-9854-e7413bc07df9
 32 93c3cb67-7c8f-5767-87e3-2594ee0b8afb
 33 ec1a27a3-7671-0bea-9b16-1976295bd928
 34 2d130376-57d5-7785-a4cf-0317e8ac9eed
 35 249f7478-0e57-8277-9be3-a63367f5979e
 36 d7b592f5-7679-0362-a703-6974d0d8353c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 387208500810365001655554434572150780. Exactly this sequence comes out of new Random(631).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 72 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs