A858DE45F56D9BC9 archive

201309150159 1mf5g8

explained decrypted filler

seed 797

Metadata

Post ID
1mf5g8
Title
201309150159 → 2013-09-15 01:59 on A858's clock
Posted (UTC)
2013-09-15 05:59:57
Timezone
UTC−4 · title 01:59 against posted 05:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309150159) = ec17b6691cdaa96bc41f52c01ed54b4a (name+title)
GUIDs
36
Filler GUID seed
new Random(797).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
61 · predicted N = 36 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E9420592C2D9B6B4 09794C85B14C0F18 6438C6B1C60A8447 2475F03F374D6A5D 8F992D00D559DF9B BA5380C4EB139D22 14A08A04D2E7CB91 842E125F99420C25 A19F6C8F05D27231 C694D4B2E3B9D730 23AF5A1DBDE72860 C055F52541559BC0 3BF0F238DD38AF17 078333A09760E10A 29EE3E748826B222 4E9748FF5A9EE627 0C7AD3ECF56893E2 8E3DDDB6346B6DD6 0A940813A47009E9 76B1538EF0401022 1551B68CC0A7E351 7FD98F61CEF51E3E D44128318122519D 4FFCA6337E5E0AE1 9FE8247BFA0F4EF7 12F40FB7567C5428 352E85C04034CFB8 929B4715C9FEFA3F 31E652996EB6105C 94209A4DD217E978 65FAEB65211F7B8B 68F737CB653A809A 6161F1A0919C2756 612D6E0A770BF12D B84371D4CE3A8881 A9929DB289D8C253 0A3FAFC93E829720 7B85E66AD5EE7372 DCC43A420479A0ED DFE4022F8E30C6C0 B1965B493E94E538 71B446A5B8FB386A EF9046A37737A6F0 D173DB6E3D33B97A E0C50A2AED91990D FB1F3BD0030E32FF 605C056DE88D4E1A D52AD3B3C9D25359 38295BE20210ED51 D33CE0D0E43E6CE4 4BDCC3ACCB0CCBE9 6F2C372C112918C8 2773FD96F9901A56 05417C9EFFB9124E 86E5D681661C5823 B27A49D64C8A6D0A DFA828897C6F601D A5685BA66634E70F 4E0C3F69594806E8 EB45773C7C28CCA6 7A368AD1AABD10F6 D14EC35019E8922F 3B7C8CCA08316C84 7B27828B21FB0396 4D1106EDF6939282 9931B1B142AC558A E877CDE66989FC1B 6DF76B4DF1CF9886 94B6E6245D6E4E16 289FAA25CC3DC650 1920ACF078759254 3AE4935C66DE62FD F46A75C74AD57139 6D741C7E004DB95D CBAE2719427465E6 12F2194D2B31D787 969C199FF3FA9AA2 59584FB94E08E1B6 3596BE2CFB66BF6E B21FC0F1163BBD29 DAE833A413A39ADF 4D43299273C76938 6F23BCDD2CD47CFD 79D5DFE1324E4F6B 96DD8A571EA564EB 3DC734C8FF9CD5E0 E2928EA677C1F425 EF0ACD41BD9D9F6C 45C6EFCEFB1BD7FA 2A47D8DCA04759D0 C5912BD43606FBE7 500DE44F25E6B776 A2E6E3DD041947D4 E281BA4D38638BA1 6BA5478ACF8D8870 EC5B3FA7146B67FC 74276717487F3145 9B991D7D4AB99FC4 2337CA7A4254D40D C156762274B3CCDB A4C2430517CC8050 7C6CA212AC52DE79 638615705548BDAD A4AEC1EE3B09DDBB 9E112795C96C514C 5E39C3FF67F23027 D217FDECBC2634DD C0B5EB09792DF756 FC8448125DE56C79 B21DEA4A6F27F4D6 082357554348E707 ACF92DD762FD161D 98B6A218DE613094 05EAC4EB10495296 D75F1F23C6E16B81 678DA850D37E6F16 1F758DAA8E33EC0E AAAF57A10D643E92 BB1F98BC671E5C58 EB9A939FD6677ECF 09C46B57FA590F56 A12D728B06B622D2 9F7E70ED33F0FC4A E71FCD2CDA799FF1 D84CE63F73FEBFFC C690007BB62735AA 2F63BCC3F4BA4E1D 5DD4B1BB7EFF5479 00BFB54A75F10E31 0FD8EBECFE4C030B DDD2111626187EBD 4D233997E779E4B3 04F97264D9EE1D8E A004AF701FDDE406 6D0103B99FEB41BF 228E6D95C222447C D4452A4C5B09C43B 19A072F3A857360B 058CE79BD87041EF 976A56E09FBDA2CA CAB56A10B67DD3F9 606653AE634D19B8 22EF75271B09544C B75984E195E3EA49 1EEB0A75339307E5
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309150159 (name+title). Key = MD5(password) = ec17b6691cdaa96bc41f52c01ed54b4a, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ef3400ba-b8ff-0c87-ada0-8322f70b9c60
  2 e807614f-1ad6-619c-91ce-44c6a8fb32c1
  3 270ed2b0-8654-736d-8f75-5d47788b2e8d
  4 cfe3c146-d1a4-6f36-bda4-a9b01b1323c8
  5 1ca367fa-3d3a-0112-a62f-629579bfa0fd
  6 89fcf1fb-e6f6-0bbb-a7a0-b9a4cd36100d
  7 e00e6c49-4ab0-007a-98f4-4cf415594ab0
  8 25e0dcd8-cf04-2538-a81b-bc41966989c8
  9 b9b11ea8-ea51-5199-8225-ed8aa063624e
 10 b6608eed-e1c8-13fa-a987-16eb21c191e8
 11 46bca67f-f505-4e60-8f13-11d22e423366
 12 0b3529e5-4291-6a76-b805-cd96a1d31f73
 13 42c0f48a-7567-4a12-8961-8e979ae70caa
 14 ca5b307a-72f2-1118-98dc-3b333a608b0b
 15 018ff6f6-788c-739b-b2e7-2521c91199c5
 16 7a357983-f80c-6f56-943f-c1f4dcb32656
 17 fa724c8e-abbf-7940-8600-0fc3fe26a626
 18 67a4b680-03b6-12e0-8186-bf9226b0bd58
 19 38bbe4c5-feab-2864-b8d1-d311e8628d9c
 20 52b0cae8-045e-8f98-b28e-0d7f3ac54430
 21 199e3b08-5813-6963-93db-9ddcd6c3b5da
 22 f9ed2935-eaba-3131-b933-8dc887c79cff
 23 bfff6c1f-c585-6a71-a9c8-cc7c205a01d9
 24 e8a8ec0d-d684-4355-844e-fbae3df7832a
 25 b418c9db-dd5e-77a9-94ba-dfa2c48b0fd3
 26 416fabdf-fabb-127a-ae93-6701474248ce
 27 f934b212-dba6-1288-8f7f-3dae81b02409
 28 b83df551-a16b-4dcd-82c9-a4f8665b496b
 29 14b000dd-e905-6ed1-a306-d8549abe66aa
 30 4c0f9dc7-9aaa-84a3-8934-92c744400f50
 31 59d9948f-74b0-372d-ae50-6ee95aa7c890
 32 5ad28ee1-33f4-3e48-998e-ce439a4155ae
 33 da95e9cf-ede7-7d82-9758-5bd1c50eef0e
 34 c03c2774-854f-8e11-bbd2-5811d70bf634
 35 012c9be8-9df4-8ad1-bac7-e3b98b9400eb
 36 5751bc04-831d-272f-aba5-af321d5a4504

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 067600025146417671286364711468337882. Exactly this sequence comes out of new Random(797).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 61 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs