A858DE45F56D9BC9 archive

201309130159 1matwa

explained decrypted filler

seed 388

Metadata

Post ID
1matwa
Title
201309130159 → 2013-09-13 01:59 on A858's clock
Posted (UTC)
2013-09-13 05:59:59
Timezone
UTC−4 · title 01:59 against posted 05:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,576 hex characters · 1,288 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309130159) = 1f8813ab69f8f9a09a55814e826fc114 (name+title)
GUIDs
40
Filler GUID seed
new Random(388).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
13 · predicted N = 40 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

FBFF64F6D6D1868F 5D549492E5EC23DF B94E1941F0E8F8BF 11A9A21C90F0B84A 9850355F918B1B23 EE247A05E6579626 020B7D7AA8569AB0 3F3A33458FC219F6 7701FED38F184574 35B4B9F1D9562DFE B8193C3710AB97F1 B910E0C1D62DBC63 36AD55FD0FEC0DBC 83B9CFEC63C5497E 5B94283879F7691C 8203D1591FF89F64 2BEC86757B7194E3 A410B5C2B10E16C0 061D91B1B7FEF157 13EB74377BE2B2D2 08646A3B06063F41 C87854B1F7FE6BE9 F08D7F6D22036FC4 9EE3156C7F91E211 7991AE09944F9386 F7766C64A984F7E5 BACFEA735F5AA870 DB082FCAD4793733 E6DE6AE4AA99F173 7D013D06039833F4 CF280BE905A503DC 0180B9BE457B7776 CE72A12183BBD4CA 45D517A0D3ECA539 FBD457B5F35C4559 F30A01B579767458 047EFFE05A92B85B 0DD8354B76465D60 C7B1ACB3FB0F7E6E 8C90A70833F911E7 2D22CBBE1C79C8E1 4F8FC8364E0AC625 240F7F86905DF3B5 F50AD94FFA2A83D9 A2B63BED617363A0 C5471CD6E7A39445 FFB9A4AE9F685169 FE907A06786E2E66 76145373A9F20051 8AB4AE8ECDA25953 2A2F27FCE0A2EB31 D94B6C1B71E170C8 67D2AC902A071437 1E6474E7F551A85E 6736EECCBB9EFF91 FA325ADFF91C35B4 8CA05CFEDFC26B0E 62D0A456C7A7CA1B A3B4F76D64B6D305 7873DAA9446DD82A C64BC747AF1B2C26 3F10DEBAA4D6DD32 AD40AF9229614BE7 07AA216D5FC7A984 198521E6B9E18B3B 0EDF6AE66EEC2086 BB64FA92B0184227 D57AF3CA2C04D72D 45480EA976ED4312 19D1D67CE476A2F9 05145C480EEAD771 E0C1F7C5975B6260 62DBAE8E638D68D1 08347A0B07902C76 2BCC1452BB0B83D0 8326BE2836895646 84C70CCD7E3D0671 01698850DE2E5A93 266510C52E103E67 98835C80ECC2A6CB A9F038C89CF23CFD A9420B05D6B24FAE AF58D403CD230BFC 7248D17115A93ACA 9466AD00727D3233 FF26F43B0A6EED7C 0221513657645184 57A6547BE47C73F2 F0D18929A35ACD3F 95CA32B0A10B0821 07933D035C288B64 68677672276813AE 2DA5D66345D10BF5 2B0BF4B52FCA3A8A 9D8D55A6DFA5151A F85A3BAF9D477DDE D1BCA94EBA0EB585 62F348B405531C7F F7A65F628012CA1D 2280E6076052068E 1AE6B85438FC0C04 06C4A5F2AE0E4136 0A40FA28428495E9 7BD4C333EC3732F9 3E2E5CA0D6141A8C 11C75AA4735D54A8 4D8DAFE8D165945D FCA56736F696931A 60BB98F14BE20B73 A62B10451E005F1D 5ABD9A7E922CF8E6 DD13E087B5B6C2AB 0EAC9A9D6448FDCB FCC066E4F4F29205 9763D459DA8B9C95 77F8A86A7A2682BB 4F5A0E38D6A148F6 150A9DBD1363B00C 78EA3498A58DA08D C39ED1B028825E7E 266FED58051B72E3 CC987EACE17FF79A CC7E7DC941B1F9EB AD6F0FD4471CC8A6 6ED51850A3104FDE 51D07A56C5A4903F 3E275EE9986C0EF6 006D02A9A0F42B86 DBE764D946F16C05 862A0B6D959BA6F6 8A1D961E67EFFAC1 1E33990292B24259 337AE6AB77B4203A 7FB483435E5DD010 641FDCB28BC90B9A CD9475A57F4FD80C 3CDC689501A4F5FB E8DE862EA75F29C7 BF0B3379600CD769 A33BB2A3C6B8647A 4FEEC6EE81E9E934 D64549F7B275869C 43D974EDBC9934BF 3566623E4B4A48DC 804DF66DCA748F56 F5A690132754D236 2D459CA5E9495ACE 7FC20B34DE41E32F 63F45139F46BE33F BACA239ABE60716D F765684F1C60553B CAFADABCFA93ADB2 8D80DF79597B496B 07BCEFEAA309E890 DE21187D6D4A049E 72BB168AAD2E6B8F DC9698C00E14AEC5 49431D0B0BD6ABFF 410FF2B8047800FB 1B3EE0CED66CF611 7F808DF3010A6D37
  • Read the ciphertext. Strip whitespace: 2,576 hex characters = 1,288 bytes = 161 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309130159 (name+title). Key = MD5(password) = 1f8813ab69f8f9a09a55814e826fc114, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 40 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cec8cb2a-a3f1-37ca-ac59-467a79058ccb
  2 69bd9f93-751c-57dd-9bbd-b9fbcd648946
  3 1b2b890f-e27f-8e87-aa84-4b88e5d14fc6
  4 ff1b4b7d-c972-31e0-8160-7767674ce617
  5 d8731881-214b-3824-8076-0648931f9a4b
  6 e31fdd72-b6fc-5c68-bb95-ac35bf7f7dd7
  7 0fb73870-f1db-60be-ad9b-3d2afb99469b
  8 c86fa442-9a5e-0622-9fbc-f42f140f67ca
  9 f7acafd0-cf3f-8d8f-bb9a-99b3a5a5d245
 10 d5eb8f09-7abf-3cfc-85e1-b5cf21f26e4c
 11 b40440ac-64f9-17cb-b7fe-6dfc87f499fb
 12 564ab901-8a0d-3212-86c3-5647a01aaac5
 13 7daefc82-351b-39c1-bc32-306c8038e98d
 14 28150199-6abf-28ca-9c12-d8fb67d4df61
 15 481f419f-ad39-5acd-87f4-5d8be05e7f07
 16 f87fe00c-f59d-3c9c-8c5d-071225e82cd0
 17 8462fc7c-ed70-834e-86da-3520b3f54641
 18 41604323-f363-447a-8a48-9e6241aa2d11
 19 ef1aae59-d9b4-1d5c-bb5f-dda7f4defa25
 20 afc81e15-1473-4471-863f-e352a4bcf980
 21 12714062-c299-39d0-98df-89ced19d5717
 22 c351e6cb-7576-0372-a80f-c38feab5a055
 23 f06562e8-6c82-5c32-8b7d-da65e9afd987
 24 844f07b4-5151-522f-a778-d133d71280af
 25 dab5624d-00bc-6c78-8b06-45fde636e9a1
 26 4779e0f5-7c0b-07c7-ad92-64f4d374358f
 27 9868fcbf-6edb-4325-9be2-a718e4a2cd98
 28 dac65742-ea8f-07a1-9cee-9b6e941ebbe0
 29 badaefff-f69e-681f-8015-ea21109aeedf
 30 88aae2ab-d1b8-5fea-a6cc-2e7e36e4c9c5
 31 ef2a745e-90e6-308c-b323-64f118ac5fe9
 32 7f4ed55f-6f11-5b21-9fe0-4d21521e822b
 33 35dcffa3-df14-2be2-aa2a-f124d4352c57
 34 6836120d-56c4-66a9-8f28-4f943ce37a23
 35 16ce502e-772e-163c-90c3-fecf62956562
 36 a5186876-e0e1-50ec-a6d9-1d39a147b8c6
 37 2bfc7d69-b96f-3522-bd25-c340b984e8c4
 38 54c813a7-608a-7fe6-9487-16cfac184655
 39 87328b90-9173-71ed-aeea-ee7894ee983a
 40 ab4fcc95-cdae-29f2-83f2-d43486bbdf93

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3583356083133253841430556040653526153772. Exactly this sequence comes out of new Random(388).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 13 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 40; the post has N = 40 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs