A858DE45F56D9BC9 archive

201309102159 1m4a0s

explained decrypted filler

seed 321

Metadata

Post ID
1m4a0s
Title
201309102159 → 2013-09-10 21:59 on A858's clock
Posted (UTC)
2013-09-10 17:59:47
Timezone
UTC+4 · title 21:59 against posted 17:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309102159) = cd05c6355de9b7086d29b2d88aa872fa (name+title)
GUIDs
36
Filler GUID seed
new Random(321).Next(9) ✓ verified
Run
Run 52 (seed 1,430,705,843) (seed)
Draw
87 · predicted N = 36 ✓
Machine boot
2013-08-14 07:34–10:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DA3B1997AFC3710A 1CCA68CC3036B193 540C14D2A4535A7F 5CC0951448B8B9BA CA84D21F8F265C82 C5C49374CD53ABDA 91E758596442A709 A1F0DB2007696376 C4363D782D57EDB0 B646F14883A73354 69088CC23C0F3539 C3B9D08928A53EE8 E9AAAE3A5B2725EF A971E0C69A2D2506 12D8BD8C557DC5E0 E58EBB5ABC3CBB5D E15D1E0E4A4A8112 8B4AB664A2D76EA7 78952678E71FA034 DED2C99D4755D279 FAB9A2A8E01FEDFB E0EAE1DE988B8F42 A3ABDDCC683948E2 7B2BFE9F9E1285A3 6C780C902EBAE7DE 1129DB33DC84ABC3 9710AEF01C4739A2 F314D3CD566D5C8B 12D949CEA00B84F2 77ED0203A2A1E12C EDFC2D573D850F20 58BE806881D22E10 A887AA3476F751CA E2F1261B094D2A3D D1103C3C200CAE88 D560282AB0D4A6D5 32540A119C44A645 7DC1A6A81DCE1A5B FFB6E2F34BF7A65F 8DC5E7D5F48C3C6F B94508025A8BC5F6 26A151A072673DD5 BE5331668FE73E20 F4FC0F777B965F71 76D13766E4DB5CBF 69B79C09A57F1506 2F6E9CB21AA1319B 60A3035B19DAE344 15F0D3234AC11388 C97ECF1EB9BFA600 0D72E91D89CCF718 96B71194915B5D76 8030A459E9599ED2 9B9616B79B278992 79907FFF516659DC 2B1FD309B86CA8B3 DF35A0A66AF1A43A 87B9037CD5940D95 97CC5E0C986A6AF5 539C9F930EAA70D4 96288D772D36961C 12008252ECE5F039 9FC67382FF088381 00FE1C3989C7047F FB03F42AC0EB9324 567509CD38435422 B3A3C8347DD228EB 6B7C061CD5D76E01 D6AADB299B747B89 ECE4B6ED2D083822 CB14818054A4EB1D 16A116E9C3AFEA02 5E5C7BCCE95CF972 EBA5D29B3104879C EB59840E22B7CF95 207F924011C89676 1C3AAD559F7661EF BFBDDFEF48B5C2AE FB7B061E51A2A1DE CD35E882A5B366A8 ADAC5C6801241A5A 6541DC94E665FB3D CBD17E9E9875F7C6 C6E9CB2B633A4CDE FD9B02B0D83C269D EF75B475420BF317 6E11C70336212B4E 5C49BC90E4FE2502 23AB5A5389658BAF 70688679EAD1C0FD 6ADC595F87BBA685 E48EA15613916547 354DBF105A7A6A62 89A2A3EC515423DE 0086381A81D2532A 0C23E64B6A6A4D0C BFC9C45E33830352 08209EF22EB2EF12 99D160FCCA9202F9 E5B04061DA1F7BC5 C1CA242D22499740 A469435865125A7C 9109D6CB9258998D 43070F7DABA1477A 98EE64B10F5D3F03 A0A5C9636FE32EC4 C709CC39B004D3F7 96703653FB2744F8 1E372F276590B64D F7EAF13807646D03 1356D8AA40471CA6 54D9B8A41A8BB36E BB4AD4DE29D2D898 129702A406F8A82F AC93FC2794104460 D29D63DFE848187C FA3946CA0DEEF80B 2C3057CC9C6BBF08 085888FDA5DE6585 0AF33BDB2C787CC0 F79220A9779696CE 2B181BBBF92BED1A 1E83E229E65E9EC7 7939D550AE9A84C6 9012A4905743AE6C 95A9526A1C3E0A4A E79F730614EFAF0B 289E0C2D5E728FB3 992B6A2B094C4271 D32DB1BDC118DE07 6E6F835DE246CE44 5B8B38810A3CC97D 15BB0210A01C5817 A5EDDD2AE9A01F30 DA652D8543622505 FCEB30CB92C33BD2 48CCECDF3F1BCF4A BAEDDCA357B8AAC9 1F9C38ED051C2E52 052ED77320FBF8A1 46071525E6BD8391 8C48DDA5B2C2D458 E06C7018255E2FA0 BDB83137B86A0154 3F1063AD51AC9C53
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309102159 (name+title). Key = MD5(password) = cd05c6355de9b7086d29b2d88aa872fa, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 257a71e3-7407-351b-99a8-15736d812242
  2 66274f87-730b-0d36-9e7d-7565030820c8
  3 6d6d96d5-10e4-1240-adb9-be15a93caec9
  4 727febeb-799a-0535-9a20-f77d176fcb76
  5 ef664070-2032-1293-a398-f315dece6020
  6 20b0821b-9652-05b7-8043-4d8fad718335
  7 2d40894c-7c13-6d3c-ba06-eff1887eb939
  8 7bda925a-f80d-4f26-8237-418ffefeb42f
  9 dd460915-aa57-6ae7-99e1-8e0b4205e279
 10 b5499068-3e56-5f7d-adfd-8c61012ecb00
 11 ed5c26f3-f18d-7388-b8ac-6fd852bcf0f5
 12 9ba42927-1ef2-0b14-bab4-83eb24d05d3f
 13 6a7b8b23-06f0-25d6-a143-c246c4b25f28
 14 25dc4350-a625-4ea6-93d6-ba8b440633ee
 15 46082461-063b-6b7b-84c6-d18b782968a6
 16 d36d45a9-1585-42d9-8bbc-9fabe3094d2a
 17 8ac444cd-c095-7401-a265-ae1e0ff19577
 18 b2378d6b-87f9-0b3f-805f-139ab7427a74
 19 afb3090a-79ff-30ff-a989-b3950a6b649b
 20 89143676-ff4e-543a-b4ae-5249280e185d
 21 a5c75008-f562-4749-9aeb-d472d6239c21
 22 afdca10e-f1c8-5634-9709-371e7dc1db15
 23 be0538bf-18b3-21f3-81b1-5b6a304d9d11
 24 83fcd30e-d8c3-11cb-8cdd-c551d395d179
 25 bb3da30c-4f8d-1473-a72c-8831e5e99b99
 26 d1d20530-6b3e-8696-b1b1-5fb112e0c426
 27 2e4a0aee-85c7-8eb4-9a51-f2c2615b977e
 28 caed4862-5481-57bd-bcd4-222e6ae0bcbd
 29 295f9992-8a15-11de-9615-972cc10fb00e
 30 8af96cfe-e356-5edd-9356-9906ea9535c2
 31 e00d1650-39a7-6d0d-9fb0-a47caf2fac07
 32 2c9128fa-1db0-0ec6-aee0-77e867c75961
 33 ec64ad0d-5f84-3b57-aa72-72f6ad226294
 34 7981fe99-a6ad-04c1-a75a-591f117e00ff
 35 76cd6767-f573-6f72-af5e-2c9afd679224
 36 47437845-2b60-6d61-97d3-66c7a9c2c9ae

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 301010646570246470354521188515603066. Exactly this sequence comes out of new Random(321).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 87 of Run 52 (seed 1,430,705,843): new Random(1430705843), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-08-14 07:34–10:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs