A858DE45F56D9BC9 archive

201309240714 1n0u1h

explained decrypted filler

seed 395

Metadata

Post ID
1n0u1h
Title
201309240714 → 2013-09-24 07:14 on A858's clock
Posted (UTC)
2013-09-24 11:15:00
Timezone
UTC−4 · title 07:14 against posted 11:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309240714) = 9e754d734075978c3600f8349eaad037 (name+title)
GUIDs
36
Filler GUID seed
new Random(395).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
133 · predicted N = 36 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3C1E6FE0D3D0F43E 1BB679A59577DD8B 1908291AE39AE898 14E077E5661CCC02 81AD4A515E2AC914 469CB6A63F3F1980 9F5FC0531C09ED80 203C61B96B346C36 0A7EB7FEA6BE4225 524BC6D9D68A878D 2934760905762AF5 975241A7E4DCB9FB F6D1949AF31AA5E7 20A775B82815DCC6 48DBF941BF74AE05 D5E5484AF6B7D23E 2454ABA7D571C4BF 5E44FF1FFF99F807 893C4C469121FF57 E4B2973F151D4086 4588321009366273 A8827D013F24F09F D28BFEAF8C4B0D59 C7D755A2A5756D55 5A0C809BA9B3B625 CA383C2C3DFC9DCB A5C5A25238CADF42 7E0C8D25D8D50F56 940CCA7B6A9FB4D8 95403C3485879F59 E1132D9BF18D9F6A 4DA7D13644862875 4FDBBC869BA44BB4 DD8E696F86624CBC A34AF2BDD0EDDDC3 B18A92AAFC51990D 5989C7F7E504B40A 008A40BB941E7436 75DA4AC8BB9A880D 4633730085611733 A30EF58225E85525 EB0E408E91FCAF21 F947B2F09FABB909 EB6D0EE4D45C247E 1803AB072C1D3936 12613A20508A64AB 0188C92A0C629539 CC1294AA96DA456F A951857F00CD003D 266A45177D448DC1 24C19BA8717402B4 22BE8EC5E7C8A439 B7AE0C8764E3920B 4D2E76DAC20C7717 33C596F163DF9E4C A4B99F35E1825E2D 323C967EBB2D74AA 5C1A05B908BEDB1C 713486C8A79A0AB9 4B6ECE20EA3E8400 01316537D1108012 C72AA5528A211198 4298FD6A4A5036C2 B86134787602366E 12708B963F1DCA3C E7302768FBA8833F B572FB07B3465FA9 AD99EA443432659B 56E3D18CC2E92DE3 F6BEB31FAAEF5D25 7FC5533D1305A2DA CEB2E747FF290A90 FEA76D57A3A8A86E 32BF7C6A12568E9A 656342030BD4C87B D5E4C5D400B71A48 E15FF333DF0BE500 E9EF9836BD5FB0BB A3D4A64625C50889 082CE2963E60E76D A9D3FB4E31A47B11 12954A9EE754CAEB FA052D9550775014 90038565A78CB481 16F207268F2E87B8 02F6B0512F179176 783B491E7BE7D289 882F3107A9652A8E 028A997F1CB9C65B C5A4157DC015378F 424B175A14E1F923 A2A987B240A4F425 17588D7D8FECA682 0A4E511C1FC7CE35 1D0EBCAE431A5B9A 8961DF1CC571C949 B0A05AD4BE00F878 B960501479DDF85A 354C7744F70A15CF FEE1D398C0A124B1 ECEE73FDB322477A 385D6D8DAFD67564 462E585397689797 12E800FB511373BE 50DF3473139A9CD1 E4209B98CCC6AF6F 38C83CAC90887C5E CC36FE9490B4F9B4 F792826AB1DB3C30 948C81B7DC6FDA63 B02437973F5D2830 2FDC8AB9209F8BC6 FB17387F6196E2AF CA50AF947D9146BA B0E5B6159B9EB6F5 FDD5EC4530B01709 DC43BE05AB262E9E DF75AC3AD04A6F35 0CB1C970C6C6CC43 9D878869A016ADA4 6BAA37BE36FDE842 20E0549415F2D947 E8CCC77D948E06A6 DF65B7F269677A61 C8CDA713C357432A D0DAECF1B5B09659 6E6D029D92BE0388 F26FF6B617C2A90B 08BBAF6CCD824B7E 5B3D338B0B0F8B5A C47E11303C9421C6 E97C38A5C055D99C 2CE2E9365DB73354 80556D4E94E18CBC 4CDB6D3CD3689B88 E1F1C266BFC4CE15 8A4C3A713AD7DE03 414634D6EDD5A818 77D4C036D53C051A B0292C64D3B42FE1 7DD6A095FD03DD88 5FF8C7F3C01494C6 4DCF4734B5FA2972 8A940B7FA7D550B9 D1078AA23E9D9A9F
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309240714 (name+title). Key = MD5(password) = 9e754d734075978c3600f8349eaad037, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 591319cf-b086-05e6-93e5-4205da4cfbbc
  2 f6dcd2d7-06e8-60ea-a54b-d3087ec2b8b0
  3 94ac13a6-bad1-7d7f-92ab-8f98e4d326f5
  4 36e70d92-3fa4-754a-90cf-49f0f298969c
  5 6ab43946-7e84-42d8-8f92-9a8f249be107
  6 3a6ea179-3a92-6895-9265-cf61b660a628
  7 49aa48c2-e81e-75d8-bc6d-7f15364e2cf9
  8 f7539fc2-6cd2-5eb4-b920-ae2446067b56
  9 57d934f4-8b3b-71fa-8426-c78a7511f7e0
 10 324674e5-b21b-82fc-92d4-a5e46c53ab82
 11 96641228-a3f1-2ff9-87f7-ea75bbb645ee
 12 307ad889-9c56-7a76-85c1-547c2a77f156
 13 2abb1c71-1aa8-107b-84a7-98e47bc966a7
 14 5e30dad5-7639-8632-8e83-f2de59d25f44
 15 215d3fa5-08f9-4599-9967-12cb5cc41b43
 16 2374b9f3-11ec-60c6-9391-0b89bd6ebb8f
 17 cb466529-41ca-8032-a6ab-62db107f91eb
 18 abfb9453-91a6-8881-ab44-5e8e5a1a248c
 19 c203654b-f91b-3f47-a968-bf866c487ac1
 20 947b44e6-505d-2d02-b3c3-eed2d1e562f5
 21 cb7b2301-c12a-20df-b3b9-9bc4aabca50c
 22 303f4464-afb7-61db-a599-28eb79d651e1
 23 43a16ddd-fcf5-63df-be40-4fca15d9038c
 24 2c0ee505-5481-0474-9344-f5b1259a68b9
 25 08856d0e-fdac-380f-acc1-3687e966e012
 26 bd3d0099-68dc-5e5d-88f0-3663a0f5ceb6
 27 6f6e4750-1b0e-4d22-b0f1-da7f7900177b
 28 f3294028-05ed-3d67-8949-6e2f20de0dbb
 29 39c193d5-d91f-5ad5-b926-22e5908d84f9
 30 eb0086ce-f410-139b-a1e8-286283c01362
 31 86e2d7c8-8320-0ff2-aa08-ab255f968a2c
 32 1cde4e8a-4208-4c4f-8fbb-09acff94fd7b
 33 a6ca10d0-05e5-187c-aea9-6a4bd0336235
 34 2df94a15-e627-87db-beb1-a948e306e5ba
 35 65fd6416-d0ee-5eac-9c5f-b492f33cbbed
 36 0a93e1a8-b087-73b1-9363-b379d7407a37

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 067746757827184688322660354351041857. Exactly this sequence comes out of new Random(395).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 133 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs