A858DE45F56D9BC9 archive

201309200032 1mrchq

explained decrypted filler

seed 971

Metadata

Post ID
1mrchq
Title
201309200032 → 2013-09-20 00:32 on A858's clock
Posted (UTC)
2013-09-20 04:32:56
Timezone
UTC−4 · title 00:32 against posted 04:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309200032) = d86399c22fb401755dc4ef604f56c167 (name+title)
GUIDs
32
Filler GUID seed
new Random(971).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
115 · predicted N = 32 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A90B88722C4E3B1C 9C27FCAB57D40E00 7BF0D4B47A193607 D86D0DE6E90BE343 BAE3FAD1768BF757 E5D3072AA3498EBD CB4D862C7103BBD8 E4CC41937903B811 01B80E60D84D645C B99F3ECC4695DA99 5AC63E29E70F3A21 17E08CA1C1062682 A5A11D4934854EEE 5DF5B11AA6EB0E95 49F241E8BA5627EB ABB830ADB98D3ACB 02B5E14659E4BAD6 2ECE0AA52364E41F C84C3191666B6A2C 184C32068CBC25B4 B76F01CCEC4E52B8 51E2E7BA23929F27 BD0CFCD5950B8202 EF25377BAD439794 4049E08542592DC5 F65C204D43EABA93 813B67764C8A1E6B F1772320DF1FE82C 6C06EDAA29B6859C 140DA3471CCDD8EC 98BA9C5671827A5B E0B658AE7A25FF3B 1D0C281159A62899 F637F09D8E5B7B1F D7431B8A79B4641D 138B008FE6BCF89C F57526C5D6CB8525 239417EFAAE339E2 CAA84D7DC1905E84 4F344409E3C42FFE 663DD97B22D730F2 65648DF1448ED83E 71793CA7933B8CC5 4B2196D68873416B 0165DAFD076E7FBB 51E4CB1231341361 6AF4F84A9FABB508 66C4376BD5B2651A F751495ED750B2D6 C935DAA361549054 3635AA6D713CED53 906710B3EBC42789 F4FD2E4AE82AF880 867F19ECAF6BC9AC DC5EB7732795137F 8E646D702F26B228 6EABFFF572A1C49F 1E7496C9664CCEBD 03096AC5A2089B94 CA20133476DC7CE6 B11531EF9C4BFF76 CD749C752EC86379 581598CB1E997033 8458D95838E071F1 54AE7A8AE5B3FF75 5C4D5C47FE256DDB 98B26CE78F0E6F79 C274EF797B37DE9E 37436522B8A215E9 635EFCDB2D435A87 AF8148D2FBBC9F29 DE5332E89A0F3D96 A54D216CAD76751D 9CE5553FCA93D884 61A657CD4BC2E62A 8730D700A0F84A71 39298E7C987CED6D CB5B1EEB1B7E7667 2BBF672E8690F179 330F2DBD789E0E4B 9974388B8CDC7F26 D0507761C50C88A4 8570ED0C6E2CA5B7 73E0561F28F1C674 2ECEB780308035CA D539B43A2F79F44B F5C41D18CF80D347 91AECEA2826E86D6 3F16072AB2A47B55 E370672BDCD5F5E7 AD747734E532EFC6 D4E4AC06487C8C7A E74CEF7C95FA899C FAB608957EE18FD9 8778CFAF45730B37 2551A9C1B64C96C2 A55045B19525014D 749CD4DC4CFE702C E2343D931F8C9BC7 7D2330486940E437 CE048982CB68DA32 D99ED049F29ABF15 A4EC6341F6669659 9B984D19ADC7C874 DBB028A59B87B7AC 768EF764D568BCBF 2AC585B4D95688BC 2CDF00DB82B00FDD 748B69AE96972139 01F21F91E19E00A9 D782929F2BCF14B4 95FEBE8760BCAD56 61481BFA69AC2ADF 4B9C22C7370A14B5 7F9DF2A37BF99217 F4D85B90E61B655A 4F49FA37CCCFF46C 3A43AD2BF4A057CC EA999320507C07C2 A9568D6EC7F9C903 66E703EC6D7127B2 14AF5F1C723066BD D9851357EE97E96C 1F74132D5AA5560F 91E155C01F5960FB B213B1C02BE5643B C65F2D5DB5D88906 9902AAABA3AEEDE9 29FA7C1FD18C7810
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309200032 (name+title). Key = MD5(password) = d86399c22fb401755dc4ef604f56c167, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 90c359a9-4d6c-0449-bade-01e3a0b2df10
  2 8bfdf851-2822-60b2-9cec-7f03fd448909
  3 bc0ac64a-4dfd-4e31-b08b-f05d6b25d556
  4 d8444efd-cfb8-737a-b644-3918f7c05763
  5 51c716df-b951-544f-a0ad-42288c03607c
  6 a2ff0c86-6180-18aa-b0fb-edfc3f40ef0f
  7 7febee26-f792-8e49-a076-c585b8aeee10
  8 c4d61376-6c91-5de0-bd9c-822186bb7ca2
  9 0d72cf53-6b43-0f7c-864a-5755fe756fae
 10 7e0f293c-37fe-2ca6-9ed5-9c60a4cc057f
 11 43330473-152a-5daf-a703-754997c2c2b0
 12 6ebce433-48d9-424b-9407-3b30a1274051
 13 82d604af-c352-14e2-b97f-a7d6609a66e6
 14 0da9bdcf-18de-5a05-85e0-da2802049a45
 15 40df9a96-cfa0-5a96-a3b1-dcb130e16958
 16 6582fec8-0226-374c-a3ac-526df6b9f9bd
 17 516978ce-d2b5-022a-ba54-55d8e58fc40e
 18 f5f79918-1345-02f4-8baa-03e9a256ad7a
 19 26750ea9-36f9-8542-8bf4-e1656a1b15d9
 20 ee9775ce-0c91-2c62-b39c-0169212ceb39
 21 14e62adb-1061-71e9-ac7f-2f9883f1c709
 22 80d233a2-9808-06bc-a2e8-c345e35903d4
 23 0abffd47-d660-09ee-a57c-437be86e6f94
 24 6b715b5c-1dd3-28bf-9f25-84ca98689753
 25 98604256-56d8-70e1-985b-4248922c1de2
 26 92ee8270-69b7-0ffd-9b5f-d4b39070bb9a
 27 1c09bd6d-6f77-66a9-b22b-baa432919b3a
 28 ddbf5a7e-9fe4-2db3-bd79-637fcf132136
 29 da00cfb8-c81e-6518-babf-355f02aefdf3
 30 82b2a262-7abd-0abd-b7ff-77f841cd7759
 31 0f31c73a-618c-5d18-af32-d879c9990d47
 32 5c52f793-2109-15b8-8986-d732d3ead15e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 06475185025415530082700270626051. Exactly this sequence comes out of new Random(971).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 115 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs