A858DE45F56D9BC9 archive

201310061915 1nved9

explained decrypted filler

seed 118

Metadata

Post ID
1nved9
Title
201310061915 → 2013-10-06 19:15 on A858's clock
Posted (UTC)
2013-10-06 23:15:17
Timezone
UTC−4 · title 19:15 against posted 23:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201310061915) = 64233e2acfba6ab1b8d58ace265ac165 (name+title)
GUIDs
36
Filler GUID seed
new Random(118).Next(9) ✓ verified
Run
Run 53 (seed 26,950,390) (seed)
Draw
158 · predicted N = 36 ✓
Machine boot
2013-09-12 09:30–10:30 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2013Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C00DCE699DEC32E0 85CBD3DC1F62D8E8 353D16E3C31E0BF6 033D8F562921CA6F BBB1D42780DAB0AB D6B1AF6A18534CB9 BEED3E4422B7DFA7 20552830944C412B 22AED8FB5B6F414B 47361EF21F478D33 64342FF348E8071E 19FBF8D5C0D7A5B7 DCBC260E8AF1379D FD1DCA2F37E3F580 B202F81E0A4545BE 368988278753BCD0 77BF041B3C6439CD 2E16EBF14B33F6D5 A4CF93661CE7E390 EA71D6AB86A43BDA EAC18E8CFBE3774D BCE01448AF35CED6 D216156C5CC56540 9590B2EE928B6E6E 65A470EB334412FE 28312C2F8A2240DE 08AC09AC185A79B8 1ED5D7C184280E18 F00A8DF153679286 ECAFDDCF16F5C66E 5EDF2B2D44050B70 78DA97159A317B47 BF6A24D4D5818979 068D9C8EF65B4D50 E08A1F39B7124D15 D4BDC6C78E8AC522 2192088EBDF7CD15 9C13C2796BF519FC 5DC2C1A1B7CF3F8E 42CB23633C21BAD6 AA0FA73F5E46601E 81EA21B57B461953 341D0AB596C21538 4828B224F72289A1 3146E41B20F20449 0A4C9D434C3A0E94 1D4FFA389AB27ADF E4547C167EEC7C12 D24071B39B57C862 0FCBAAA9C7ED1E12 9692AB1622344FF5 91043CD828D93DEC 26CE60F799FDE589 B35D2801166D5C45 08476BA8C3EE4350 47EF2A2BF3765BA8 A226B3BD9849BD20 A15F679AEE18AFF1 C31CA57BCCBAFC49 0C9708BE0D8C3080 B5969A551B37A626 53817F437382B07F F981ACD0BAB14B47 FDFB714F2C851A48 659F86D1DCEF2462 7ADC5D88086A7C4E A2259F27BDF55D11 50249FA033C98B86 D5AB8B8176DAF8E8 9486CB880B8799B1 59ACB532678D63F1 A67E0EAF2C43ECF0 704BC5917FC2666D 41F9CB716C03D0F3 2CFDCB9537FAFB7D 1CA7E3A68A137E50 1ACFF1168B899D78 69B8CAD3E688A827 B3BB59D3B86EBEE5 2357959731D1CBE2 255B5E08433E0F39 2CB08103335FD02A 88B49604B30F301C 7B23F164AAB45924 336BA283313E5469 F4DA17E6A9DDD5B7 0F495ADC5C848B23 E1AA668C8C033CC5 06446F19771396C2 85EE48B6C1FF748F 27745EDA4189EAF6 5BD08A839BDB7CC3 6A7ED6054020B566 80410633FF2D2F74 DE1F6CBAF1A59E5B 7DAE6DFC98695ADC F1FFC02725C919C9 675D0A8397F12975 176FBA5326015E1E F531AFCDE098E7BC 2BFD82E8638B3A4F C3C89291C30B9D06 43F5C96626539AA5 CB5205A0C1FDE527 47BEC3148DB6EC58 2FC0004E2B95A59A AF14371F3086473B 31E07FCD6EE2CBE6 4F84C8D4B0C57A72 B29F01C2FE2E24F3 6C33474235233B29 47DBB5206C0D3586 EF423157769A623C 1263BFE23EB7D40B 6D163B6F6CC4CBF3 630797E80D32B2EA A2EB5D17DC836491 6A675132074F6CC2 8307E5B7D4D08DCD DDE295C5A7DE1666 4C4285CA9EEFA811 25133D8928A81CFE 9A220A638DE80E1F D1F23561BEEB3482 A71802978ACFA9C5 19F311F565DB2F86 4CFC616EA1EA633D 848456AF090EEE63 9A11D83F696BEF33 0B957914678DADF2 BFE3964F4B451D8F 9F4C83D26552FB79 96DCC6114EEFEDEA BB5224BB8AAE6819 D70C43A19A727D52 F0BB176112E41FD9 23A2DD72A378CD69 FB9CEFFB018EAEB7 3C7C17DBC1BD5D40 9CF6FF3F22D4A6DB 2AE91A637450D578 8196C5203BEEC9A8 37EE24F0ED287330 E0C275D520483C66 F3759A183C69E6C8
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201310061915 (name+title). Key = MD5(password) = 64233e2acfba6ab1b8d58ace265ac165, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 40cde02c-4b34-3ec8-8aff-8b7aef09aa69
  2 b68ff8c5-3f41-3cf3-a9e8-633e4a280d5c
  3 97f6defd-cc0a-2bf9-b502-9b77893f2c11
  4 d5bf8d0a-f60c-69fd-8eb3-8d8cb05ecb80
  5 f75ffb79-94d0-4ac1-b7be-e27d164dd082
  6 380796dd-aaa9-6b0e-93eb-411990d58e77
  7 945ad5ae-b998-69aa-9ed9-26be6a94919a
  8 e6369a05-2f2e-55c2-8a7c-8ce03a68a5f8
  9 c8eef7b0-d7b3-583a-a71b-d802d30f21bb
 10 cb17f528-1abf-75a1-b62a-a56ff5094286
 11 5e140d05-3b5a-2cce-bc5e-598c3dd75ded
 12 64600819-593a-55e5-9a99-07fcd983a3b5
 13 bb961f6a-b60d-6475-88c8-e9fcae32cca7
 14 9f89a037-f257-7a74-8a79-227f784fc80a
 15 70feb811-1d4c-59b5-b178-577a82d0b27d
 16 63b580c5-b173-600b-b45e-bc8b87c6b383
 17 25e6c650-e1b4-4408-b505-1640495c7f1d
 18 2c08152a-01c6-1371-b67b-d9285fbdaabf
 19 564705bd-037d-7806-ad22-bf8dc5f5d1d4
 20 2082d809-656c-0743-96f8-f06565f8a0f2
 21 33d42bc8-342b-4c38-a311-6dba754f807c
 22 3ae427d6-a80e-7891-a1ae-77bd956a3330
 23 ca3d5c71-ba3c-8e08-9b5b-bc97069aa02e
 24 4adaf979-1294-246e-820a-0cf9ae097f72
 25 fd65199d-162e-2b44-9989-c71d5509e9f6
 26 accff046-42ce-3f09-93a7-2250d9e00093
 27 30aff837-3b16-335f-93b6-d4ccf611b970
 28 4a281287-e1a3-7749-b75e-b1e3a2a6c508
 29 d06d24f0-7f8f-1cc7-ac2a-bbb95c57f91e
 30 8f5e7019-910f-114a-b8dd-b18a2fca7156
 31 b93d9fe5-4f21-61a0-bbeb-6fad97fb09a4
 32 67200485-48a1-4aee-84c0-db7c7b6cff79
 33 fda41979-c284-6ba9-a4fa-8965a5f5e8fb
 34 f1d8f091-0677-8102-b2ea-6595af0d935e
 35 951bf775-4400-79c3-838b-4d034af089e8
 36 67b81a37-06fd-7ce1-a3a4-5e60fc17255b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 332646655725675641704782233711646877. Exactly this sequence comes out of new Random(118).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 158 of Run 53 (seed 26,950,390): new Random(26950390), 4·Next(1,12) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2013-09-12 09:30–10:30).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs