A858DE45F56D9BC9 archive

201309290714 1ndaih

explained decrypted filler

seed 234

Metadata

Post ID
1ndaih
Title
201309290714 → 2013-09-29 07:14 on A858's clock
Posted (UTC)
2013-09-29 11:14:55
Timezone
UTC−4 · title 07:14 against posted 11:14 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201309290714) = fbe1074790d88f12228e6f503db467c4 (name+title)
GUIDs
36
Filler GUID seed
new Random(234).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
143 · predicted N = 36 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

816C7C74512E70E1 49F9F87B12F63C74 ABA8E09A39640FC9 5BD64B302DDA5813 315356961B2C4A2D E128C30C99CC04B3 4162BEC330F62FC9 212FABC8E45EA4B8 E0E0A39D40F721E2 8C83069F72A7C97D 0DFFD3BD3B64D11C A6772933CC2FD02A 3CD9055BF4D2C3F1 768DD3256C3194BE 49AAD4287E9E1767 98BF3C44F798A17A 8D521AE131BFDAC7 947B243F244CA246 D0774D7A812572DA 5A1E572778E9C757 DFBF8875F1DE2C49 C148E5170400B35A 623B66EE2F210AFA EE27947314496735 3442BA291030A754 D309BA9B6CC613BC 149486CEE25D65F8 EFE1CFE9E4D73363 6495E37FE7B77BB9 185E81A3AB7FF76F F030059376073485 1F9DA56A3A31BBA7 469196FCE0F08508 F4776DF27E5D7606 543D1B7E82AB55E3 66C693967A23E489 1FCCBC6C49D75012 CAAE75CFD3623A8D A07CA1D5CE6B15DE 04C1008C10873484 65261125CFC9534A 1203160F39B6E5BB B23142464725F58E E6598973D51F4A08 F71BC1D8CF3BA521 B7A120F0F4C090ED 671DF90BCDEE75FC CA8BB0D09B8CA199 CC38B04504B76347 9BFB7E0E5582A568 3B4AD580B3B49FBD 7E4723B3FC3D07ED 5037EE2E338DF47E 9CC1FCDB571B6CC0 D48A5DC1CA65510D B6A392C017BA3181 225C18035F8E6ACD D22B7D3A7FD2A0D5 78FB37EECBAA8894 2CC699F65CFE20F7 DCF56457CDBFC3BA CCC34F495D13DDA3 DF997D6240C24907 E62F2B0E4DF831FF CAC6269375D4A3B9 5F03093CD19FFAF5 DD0CA4C09E0E395E DC08E230876DF839 43048AE407AAE2A8 467A8ECC167E5673 0804E9E62765E342 484C88B01E60E626 3E201C4689F17701 D86BB0606E0F6C29 7DEEC1F136CBCEDB FD470FBB644A7D6C 68BF05340605A36C 52E14566E58015A9 BD8CA62038CD23AA D5A8EFD9BA1961AD 14C05FF71993C259 F6FD20E90F7AEED7 EF56AD8F0323CD07 73D9B9549A552747 94D9CA41EF47E1CF 943D24441EF90301 8F6D90B8F43FB0F8 FA2E204C39B0D041 68C7E65610955033 1F032FFE764463A8 8BDF5A9C66DEB731 2AB6DA4AF1B9F8E0 6719B072B7B88937 0237DDD44CF7C67F BD70FD11A52B92AA 952E4C180CBFDE7A FF810DAC2813A21A 31F7A78D30457B9F F2B1FA31672C4494 C03820A2214E4ABE FE9D6314FFCA550A C587029776577CE5 C1D58B791B443EA7 F3C05056A4E9D6DC 0926C0B9F5C38D83 A560ACC370579462 170456E920781B05 9174CCF683FD7847 FD33C1D2210FA0D8 BF016E731BE5F092 3C6CFAE19F64A41E E849DAAEAAEC396E 133662977285C4A9 40C22AB25C676550 0BFFA790BBBEFD53 CA031504865D2F1B B8E4A2230ED6E2EE 9FAE060113E1B3CA 5D257A225725A399 DE8E0F277D7F344F 8A999BEE00B0A8C3 66C103CC76EA9B8B B9D091F36EE16967 2AD18745B26637D7 73AD94C0901278C8 150C2331B0CCCD50 60A999EFE1CC8A74 58A1B64F11175313 5A3E12B82A26B596 8C57A0DDD0035480 248B6B46F2B70FFD EAE4937601CC7D89 93445840E9CD6E9D A2504748E0CD8FE4 FCE5D6072DD49B81 DB6571E5D823FE0D 5995FAAF450B6D7A 40B11B344DDC0C09 A03D1131AAA934CF CF2A2FEEEF08DA4C 87B230E29D1FEE42 15B7F0EA5CD17ECE BDD4437EA2388BEC 70904C3F0D42EDD4 0CC348B2CB127116
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201309290714 (name+title). Key = MD5(password) = fbe1074790d88f12228e6f503db467c4, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9c275ed1-baae-8ec0-94f6-71265b068d2f
  2 a9a846bf-e5e7-4311-8dbb-ea58a46bdf3a
  3 2a468ed6-e5e3-2c81-a4bb-7c539f8c6c0d
  4 b4df0f8d-90bb-4ff1-abab-506f3fe5a2ed
  5 a881038a-3ee4-758b-babb-a9bf4360c0f5
  6 cd8cb69b-885f-0c87-a61f-e2429746b89a
  7 937e8da1-a1bc-6ac2-a926-6903f9f61eee
  8 a15303cd-fd66-7f2d-b3bb-0e36e67fd37d
  9 14661ab3-490f-8f91-92a5-52ef43be3882
 10 75785e1d-2043-502a-a0da-998081b0e2dd
 11 ef74e036-a7ae-65a4-a5c6-4da6be9ca672
 12 98f0d312-3ed4-16a3-975b-921a502add18
 13 3b7da99f-c378-4739-8e9c-7ef346b2a19a
 14 6d424d68-dece-1dfa-b614-4eeeb92d6e2f
 15 ae562f4f-50bc-6205-a83e-72e8edb28bba
 16 031e1795-891b-1b4a-a113-612dde4d5419
 17 6f094934-0e67-288b-98af-b864662946e5
 18 1f8362f7-859c-0ce8-94ab-aefaf8ae21ba
 19 9a850b44-eae9-08d8-8fe9-b25cce5a071f
 20 fb34c714-48f3-8d18-a075-410b1e5369b1
 21 9ec4749d-5279-8614-9b43-87a362c3ebd1
 22 a4c0729f-d115-2bb1-97e8-3a4431201b09
 23 35eda999-790a-425f-bf8d-3fdad8e3b438
 24 d2b6d300-8fec-7604-a17d-c5abb9e63767
 25 ff93274e-48df-5bd6-87ce-93693b8bc79f
 26 3b710c40-feb7-004b-a444-938e0fdea421
 27 c2fed74e-bf9e-1ebd-ba6f-101b47df84cd
 28 a20e8838-4902-6143-bbf4-d882da93200a
 29 06b1132b-2bc7-1c52-84e1-5d23f1af0279
 30 468d1d0b-f86e-4d4b-b14b-4a878884547a
 31 795288c2-4243-571a-be6d-b7aa91a097a7
 32 afc67edf-39b3-0596-b250-f49f8855b00f
 33 d29bf16b-542c-3be3-9e7b-127314988197
 34 3418839b-8461-7a1c-be25-8bf3d57504b5
 35 2732e1f4-dce7-3dc4-a6ec-e3b976d4455c
 36 3c4e9698-cd1e-8783-a165-e0c416ac978d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 842470678561416120088247501614503738. Exactly this sequence comes out of new Random(234).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 143 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs