A858DE45F56D9BC9 archive

201309130359 1mayhe

explained decrypted filler

seed 338

Metadata

Post ID
1mayhe
Title
201309130359 → 2013-09-13 03:59 on A858's clock
Posted (UTC)
2013-09-13 07:59:59
Timezone
UTC−4 · title 03:59 against posted 07:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309130359) = d2a592b86838e01ee783fbd2e0c2d4de (name+title)
GUIDs
36
Filler GUID seed
new Random(338).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
15 · predicted N = 36 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2C5B1BAA4ABFFD24 147706469BB6112A 5E4E5E3BD4D90294 32FC219B030C3E6F B4C2C485B19D5E84 E21909456213181D C53026C6CD65C5BD B19A5923E4E01811 B6DABDACF279C295 1A5EAFB3C9DB27B2 8D71DD9BF5C9F49B F74A7B4CF94F8237 D29D2615668A8CA7 32629E8F7F2ECFDF BA3CCB47A11E66BC E48F0FFA62F17258 699A6A38AF609AE8 3B955D08B74AB08B 38B7212F53DFE59E 6557C2FC8F00840E 448254997C067E26 7A2E4D1235B91C02 3E30C01F9BC8C092 99CB1E92C6002961 6BBA5389F60AE738 392E2BC308467DCB 92F0C7D7DD710230 17D3F4E277456075 241B41779460BF80 413FD7A9B4E1616A A9AC251153101CF5 FFD1FB3CEAEDE51D 969AB0AF5EB578A0 16C429807D6F420F 170736179F372D61 1FCB94DDC9719444 DB0208298D55FD43 9E513665DEA20F4C 05870CEE629CFFCF 8202B9FF11DCB9F9 ECDC383E1CC54A32 A391D6B089248FEE 467C2717845EA0D8 0F9E5B8545043F60 962024ABE6754D4D 1CB9DD8AA4AB68A3 1628D184FE8195BB AC82726725097388 491F30589B591637 4D9F4E44A40DCD5C D58E0741145097B1 2DF7DC1A8BA643A0 7A49833CE5AC7773 31A25DC1DDDD0AC7 5BBF9158E09DED46 ED6E51EEAF9B443E FB8472CC4CA0ADAB 5C92F7C173C3EE15 C01ACCD8FDF749A4 3D70F27934E4AA5E EB9FE14C1D8297E3 014B599B00141885 26E1261916DBADBC C901C584A9DFE642 981C225A7F70DA3B 2202C311572E635E 511CE79382D64977 58940CDD941978E6 63B0AB336AB059FF 00EFA788C5A20355 543191E5F77B4473 24E477049FEEF25D F6A30B73D9BE828C 6F98C94B9E92B511 4B6ED4C530F5FD01 688AB97AB7B383B9 C979016B7EA98550 5ADFC8973243E00D C3EAC8C89DDCE378 54E533960AA599EE D43A996C77C1148B 42C42154DF2D3B1F 7411D7E361EF1277 CF2F118BC4EF181C D3B701CED307FEB0 ED90B00D7FD1D3CF D5B30BF7384809DD 77DFBC8A45FEDD64 5B4AC2AA80657E5D B6CC4C590D2122ED DF68050365ABB6D9 50589783668CAC31 2D7EDDDDFD6207AE 88E8421DEC435A0C A1D58D43464535D7 5CC06C4AAB7DEEBF 99D7C5D59A548EBE 06022E6FC35A5914 36E928A8B13E9286 043FDEEDC018F759 C6A1FA96F35550CF D5B7515376838934 179052F422978290 D02204CCF1B5D942 EFF58A1EE4794B4D C25B2B0DD08A72F5 57171BD265622EE4 B1119B10855DC6B8 E64825B7574675EE DB6CC0C078B737CF A51EDC586C505268 D919040B4511AE83 A661335F5775535E 9C7164BA431ECB0F C6483C3018E6CB0C 80DD3880D399CD3C 1D69CE2190F96E7E E54591BC231CE4B0 3F19E1CFF47C12F5 01158449F361B7CA 988D20D0D6F7984B BCCA0362F6EE9DDB 7C13CEB5C54F30E4 298152E36422361C 252031B8FC79CF14 67B01B53CA9491FA C3C8246EE4CDE4AD 7C1BD12F34A68215 E1E0506584232B2E C13475A96235F1AE EF6AB0F7E1F6A9E3 5FA619C9B23C20EA A13C27569A3BA2FA C6724AFAD65C291D 51041B1038E6AC9F 304F5C9CAC9602FA DBD98283399167A8 A55989FAA02E0CCF D9CAC0B6CBA01392 67CEA393D15E3A77 D3EC1137C8F98F22 3E11AFB8A93E7902 96D82309C4882E5A 85DA230DB8005883 DB54E6A4673DE8A4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309130359 (name+title). Key = MD5(password) = d2a592b86838e01ee783fbd2e0c2d4de, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8ab220ef-64a9-2ef5-8677-6ef2f5823546
  2 b2649960-49ba-87b0-9c95-468e235eb594
  3 ea7d4832-b417-070c-9ee5-7c01ac4f2e3d
  4 0a5de37d-d619-6b0a-9cee-f89917008dbc
  5 02498303-414b-79c5-a573-27f897682cfe
  6 e1622707-8176-8da4-ab35-498f17ad0a06
  7 c774fd95-5a93-3bad-b5c2-60fc46cbab3c
  8 670496da-efa1-0f6d-bde3-674679b70a45
  9 25eb7295-7c81-75ae-bb98-a21a37541c6e
 10 2034b42e-cf73-8ac4-9049-1a4ecb66aae6
 11 18da9002-3863-2e55-9f0b-54802afe886f
 12 f2849370-e4d9-31a6-8fd1-4447ff276b71
 13 2dae67e8-c5dc-8eab-856a-84bf53b62b18
 14 2365e525-1df0-2d3d-ba5b-e114c95f6369
 15 8129f61b-4e9f-5cf6-9502-158d9ece3a71
 16 8d5299fd-a1e8-1e2a-a23e-e07a96a68909
 17 3f5619b1-1a74-8917-8a55-f1f1cb939def
 18 7cbaaa8d-8f0e-48f7-828f-a9e734666a8d
 19 83629da1-ee8e-7178-a36b-ae8048807482
 20 e12ff361-da68-1e69-908b-2abd653dbfc2
 21 8475d5ec-9b18-698b-a3ad-ac946cb332ea
 22 d91ab1cd-a783-69e4-a8e8-3120b42af897
 23 3bce9e9a-77c3-1bb0-b450-4dda9d005937
 24 57a7a0de-5e04-1d74-bc02-9633db783b6f
 25 ce687c8c-78d7-7590-968d-3574dc8b4071
 26 be46fb06-26a1-85d2-bceb-1e9d01758b42
 27 c377c79c-19e0-4350-afed-9e354a310585
 28 02b6ad9b-c247-1e06-8c2d-0efe254dd641
 29 98ece03e-d52d-88ee-91cb-cd5e65a811f4
 30 39f3ad01-b72b-2c72-bb22-027f83cada90
 31 8108d1b5-ffeb-8785-8b03-c37015fbb486
 32 13a0237b-6570-417d-913b-06e9b6d7d271
 33 8a7dc61f-b2df-14f8-8908-fc3f28f5e754
 34 9d2eddda-2fc8-458a-ae7a-436a96037b93
 35 44a4edb1-671b-5c2f-8fd9-cf719c0d3bac
 36 37404f72-5c0b-3b7a-828d-7c7dc8d7ef1c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 280678307823825184716611784182841453. Exactly this sequence comes out of new Random(338).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 15 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs