A858DE45F56D9BC9 archive

201309130259 1mawg0

explained decrypted filler

seed 434

Metadata

Post ID
1mawg0
Title
201309130259 → 2013-09-13 02:59 on A858's clock
Posted (UTC)
2013-09-13 06:59:59
Timezone
UTC−4 · title 02:59 against posted 06:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309130259) = 17d95940efc5bfcfb995ab75b3d78b73 (name+title)
GUIDs
36
Filler GUID seed
new Random(434).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
14 · predicted N = 36 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1FAECC259F5FC148 A76B4D2C81947A82 D73B5FD80FC3F57E 5359FB46FD11A841 84B3EAE2BDCE31DE 2258DBA60939A0BA EDBC583C13F96785 CDDA2D4332F4D89A 97D1A40F4D3CE010 7AC92A087F7CBB9C AD741C42FD3DC784 68D1ED840AAC695F 04266F915045892A 2FFEA923414B2097 1EAC1CE2CF35727E F1C7E94B43CAEC56 0D3ED01FE46FC26A 61C9E44930FB301F F75102757CF81E10 2B1E61770D8CDFFC C6BC6C842D1CCF2C 1C96643FAAFC1151 0E3B2F907DACF1B0 18FA7CA924080BED 9246739914A49D00 5F7DFE5F97F7F56F D69F46E2582F2B68 153987B5D7899148 5D640045FE6F7ECC E110698AFD9EB2FE DDF34CE58B5556EE 4780AD55F5363DF5 4F5399BFB90FB972 75ABF410E4E07A65 F785A764C2FFB41D C6C2519589758DCE 21DE6983C2FFDCEE 1106E817AEEAC117 DDD4456843F21D8F 21543FD67F46F6B2 08F80CA49405EBD0 8668AE0D35BD3685 CF50193825DF1A17 F37F82C9FC13AB4D F2DB515FB12C57BF 26C365130C44806E FC91150449471579 F9B49E7868F8CBB1 BBD8AD57F244BC67 D078851E2F4500F7 3548497230DA88ED 2341B81F85F187CB 6B70635DE660A897 7767EFC23E60388F 72B977E400E9448E C37D69655008CAC2 3506B03CA9ADFDCA 40B53D03F7BF5A2E 2F0FC101332BD065 7F732A87EE75AF0E D55C76F136234E6C 1C64569C3C68E344 77186EEBB1A8AE36 DD231ABEC9238DD0 3B1B6132DDC69902 20CAD712A9F7CDFF F97624AF6D0CC4A5 A8FD0405955349BF 466D0FCD3C189520 01BE5E8E40D079FB 0316C3FD08A031A1 2A3D6645A9BB5EC7 855D7BCC22D70086 CF27AD7AA9850EC4 22D378D73194694C EC719371BC58AC4E 380BB029A7A62F24 78032C2EBA65533F 8312C06B656B8C8D 6BA3148B91DDBD59 335941BC6D6FAB2F 8386FC11E8C228C2 056AE61CB71336D1 A416A32CE6E7295A 1DC05D21AAAD3A37 C01D08325084DA8F 0F1832435526DE18 038F0C66EEB47B00 1F7BFA1A451D7054 22E5296795F60328 8791D2E1451E56BE 7B2ADE338C586358 059D40B6ED407691 AE3C4160595C359F 4761387900B4B32F BEB817CFF6F19578 EB6507D1E484A717 1E4BA7B4DAFA009A B9E009651CC7E71D 4CCB353B5D6F9803 69A01F2DAE552377 9E643A153AFC6CEB D81E9C9E0758ED5E D062DFBE7BCE3CDF 59C9912FDF39BA74 4D0B6222F02C3EF5 2DE49BADF685A5D1 0406845BCB85BA7F AF9E365604D6CAF2 69254F8684F7FD05 EC02B0A88BEAECB3 B67F754D5C60F43C F7FE9706D3F4CC3F 81289B54E435908D CCDFABE8146267B5 2F9B172A6C14FB4D 93DB10FE3ADE36CE B88E847ACD27F3BD F48E7A4B8CDC67F7 DA2099466DEFF44F F33542BE5C8043E7 894A27475C8738DF 89F673C8296ED7C2 E2B4C41ABBACC247 D7C4045F45E21ACF 9091FDBE50BA9F64 D01F35E9367286C1 22839BDD9FCD7F21 A877BDB0CF6B8FB7 A9CDA4C969C14AD5 A856FD7936E2A880 62E518B5455A128A 10FFEE815A3B35D7 817E3A30DFE96947 4C03D0E7DB83387E BBC6CE45090E4FBF 9D386F4472A0E4EA BC81E00A09896329 D200C5BE29782292 45148C3C2C1E6C25 C9897DD6E9E8D280 415B8EE3E3933621 284362B0501036E3 49A2A80AE6459AC2 D134AD85565A3BDF
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309130259 (name+title). Key = MD5(password) = 17d95940efc5bfcfb995ab75b3d78b73, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f12c67d6-2e77-4fd0-b957-aba72f239a7d
  2 345ccfe5-f4ca-15cc-b146-7cef4a2de59b
  3 8a3cccf0-e871-1b3d-ac12-fbe56129dbdc
  4 bacfc9b0-69a5-1aa3-99b5-bd55d93ae4d0
  5 b06eaa88-1300-1204-bb80-a3878e03e18f
  6 50b29b6f-8790-727b-ae94-0615eb76e9c8
  7 cf1c13bf-a274-32d2-a04a-18c0bc2fd0aa
  8 d8949926-63ff-17f1-baec-6526f5a64a2e
  9 f3986569-0b06-6d7d-ba56-82535ff3a2ed
 10 8c438f57-5863-2f8e-b804-021acac27654
 11 2661f29f-656e-0e76-9990-665fda0a3014
 12 7ac8e5d2-3a9c-20c0-a308-2d75110c5819
 13 7fc5ebfc-8d8c-81a8-8a6a-67876d72d425
 14 319f5b05-be0b-23f8-86b3-1dfbe04b276b
 15 df319c7b-6c23-6e18-bb70-c139efa28f38
 16 3585b382-cc03-0dda-8fae-06c885b05a33
 17 379fc452-624a-27eb-bfa0-50bedded8dc8
 18 c82b5c62-be1a-0ea7-9316-4148bb3ee654
 19 5f5638c9-dea9-33ed-b555-afd141a3b6d3
 20 ddb8567a-31e4-31a8-937e-a6a3c37d10b5
 21 3a71cc66-f4da-4d75-af4b-5126ba99f813
 22 d6f23824-bd1c-2d5e-b8cd-cadfb443e3fe
 23 8622184e-c870-3506-b079-8087dbde5eb3
 24 0a035c14-d7c0-548c-b45a-11fd0d54d1fd
 25 8a4ef94f-5235-25cd-83fa-77e910d62e10
 26 f75c34e6-b27a-631c-93b2-e84aa909c730
 27 e922d811-03a2-0a71-8751-2064c98447ef
 28 4c8133ef-77a1-5dd4-814e-78c42846eeb4
 29 cfd3a312-28ab-383b-882b-baf0fd59ec5d
 30 df48b8e8-52ca-5afa-a979-cd0f0d6b5c66
 31 0940f24e-7218-3fd4-9e04-db9a05444e65
 32 3ac27f9e-14bd-6ebe-b79e-199cb843e0b2
 33 24be1f2a-4e2a-7354-8679-fe9e12d2fe2d
 34 f988a16a-4a0a-7cd1-b827-0d38918e9e0f
 35 d0161897-1126-1620-bec8-fba23a8c1e7a
 36 52327980-cf3d-5f12-85f5-88d9a03d0995

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 411117316202826020334235260535367715. Exactly this sequence comes out of new Random(434).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 14 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs