A858DE45F56D9BC9 archive

201308131959 1kbc72

explained decrypted filler r/A858DE45

Filler on r/A858DE45: a masked GUID list, 36 GUIDs, seed 668. 3DES, key MD5(name+title), as on the main subreddit at the time.

Metadata

Post ID
1kbc72
Title
201308131959 → 2013-08-13 19:59 on A858's clock
Posted (UTC)
2013-08-13 23:59:51
Timezone
UTC−4 · title 19:59 against posted 23:59 UTC
Author
A858DE45F56D9BC9
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45 the main account's second subreddit, wiped in 2014; what is known about it
Category
C companion-sub filler (r/A858DE45): 3DES(name+title) -> GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201308131959) = 3efecd21e2d6ff296f9b71c431cec516 (name+title)
GUIDs
36
Filler GUID seed
new Random(668).Next(9) ✓ verified
Sources
wayback · body from wayback
Wayback captures
2013-08-19 23:43:45 · 2013-08-27 11:10:40 (UTC; the pages that list this post)
Links
Reddit · JSON
Tags
automated (decryptable)2013Encrypted masked GUID listr/A858DE45key: name+title

From the post to its content

As posted (encrypted)

018CF0FB5E81F620 81F51BA43A9ED012 8E81BEE437731212 D8001B24861619D1 B1F48DAE7ED8A687 D0F7CFEEE7665B15 0D61092A43A87EB3 6A0978C10A36630E C22ECBFC0B132675 566013D010874883 EE72B64E874A2388 95643B93AE48B17D 5FC53B0D790A483C 689A7D725F89655F 88AE22828999A01C 48DB76DB9845DFDD A39473BFAEE12798 70CB0ABA607125D0 195222B9676110F7 156A7A16562F8CA7 6EF6653753E503ED 0AF4318FD3248B35 A420B10405BE2B12 5EF50E4D356BE3CC BBFD5C1F32A9F396 75B720E46391ED11 2470303C31682D4A 7D0D94E79A862744 2367D43794B83AD2 2DB03B3CCD25F840 81CD543657E02125 8C44130A9E7BF98A 4702ADA4EA1D9C4A F5C7070160C414FC A1A96E56478165C3 7126660DC11A3C44 3E493EA9A47FE604 ED6CFEF70A09FABB C9C86C249A1E633E A582178D9AE1DAD2 74143667E977BCE3 738C52F10EC6F6E2 4BF8E893E9C57E74 B4405DCBE95E744B 5D2C9F495DFB7BE1 A49C8CE00B694862 19AA88B67902AFDE DA683DFD69FEBADB 7EA4A3CC939E582C 7AE85F6E7C044678 21AE95AA9F15F13F C7023E92CAAE3847 3F97C290708AB3F7 D509AF314F0A7B6A A125199B61F58DD1 F73815D0D36E49CD 63DA82DD7E2492D3 87DC7CD3D08DCCCF 2E7A5F92AA894617 8F613B07CFD3EF78 009F404775FC8905 C8E964AB4E99552C BED363A897F413BC A707391E26767BDC CC256FCCCD3A7AB1 A5694BD4BB761E3E ECDFCDE1A82486DB 941EFF2D2B7B1F4E 7EAA79C7BF7990C1 E0D4116B8C570C55 F79924B0894E2195 5C90F09BCA16CF2E 605B779369B5CA3C E9397C784F1ED50C 0EF78635DA1447E5 677607228EBF61A5 CB9FB3EC0CF6F217 E62A147437585D5C 6E48DF158415322E 01DD70129B813839 D29918D244C08B97 F88E3E5FC90AB145 91BB1CF48572E569 9F64A466E6100036 0979CF5F5585E2A6 8E56A6E574643EB7 082E0059445DBFD3 720BC0DBDFDCE14A A6F4491E3AC9C7BC 79E9416402F71994 31DBC0114A4C33D3 324E33B1FD58196D 85EB9F682B9ED2CC 66430D141FE229E5 293FA155AB014D97 3247098AE96E20F7 2AE07CFA7E70A040 202A19B3C9772D63 9902D60F0256C2E9 7A45B5C51380A55F 95BC8A4E52105862 42136659C4BD0055 103F5CA8F4F1CEFA EB2481C99D82C364 D9510031CD2DF13C D04041F80792999F 9BB82E6276D77AA1 56A6896A50C2289A 548BF0466F253D6D 97591B67DEBAA142 BB388349BEA61DCD 8F90ED3AFA5BBD7B 55F66AC2AA17A0E1 B267F6D468026C2B DAE60D183F957593 67B79A75586389F7 C917BEC9A2FD80D7 C38423B62988CAA3 2AEFBC4C1A8A7669 D1F6DD1036785CFD 2BA7B0F7625A6634 07FBAD2DE51ED051 768C24E0C06E1752 FE967BDA2A2004D4 F2A46D3FC95FA140 EDD12A53DFD472D2 13EA740BE759D8AC 2D9E8DE348DCCC35 F70B88732F5AC7C4 E6FEBA9AD4B2B4B6 66B390CA223E3DBF BE6F85D04EC1A15E FC42E46AA36C3E55 5A15387A6AF1CF55 B56FFA7371181C23 8267B4CE7945E697 D4B4DDDEF06A3B58 CE891A82C40DFE86 2D0C1A300A9A0B0A F001376096F580A7 7E3A354D4A84B8A4 7966E00DA6FF71AF CC492B6ADA9F4048 F917F8AC85EAB129 A093A52A558A0E54
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201308131959 (name+title). Key = MD5(password) = 3efecd21e2d6ff296f9b71c431cec516, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9ecddf78-bfb2-6c53-b86a-4a496cad0c7e
  2 47e0a65c-bf7e-7902-8e81-4b57e930a79f
  3 d1b6eebe-5fc6-6b52-85b3-2c2f8f1a37f2
  4 0dc0fb7b-0082-1789-b6f7-2cf3846f3459
  5 7fa7d238-2f0d-79f7-a49e-82e04c9aacd0
  6 f2eec40c-1d24-2e71-8bc0-d899d54679b5
  7 d7ed7d8d-8efb-1a0d-bd45-b63d1d2fbbca
  8 2ec015db-e80d-5ba0-8f3a-e5ed8a2db422
  9 8bd67b25-d6d2-574f-82bb-5f35590ec248
 10 7a004069-410b-5bf6-8014-167cc1ba0fb5
 11 3467a7b8-b728-376a-bf01-d3c9e15c766b
 12 f7bf1b6c-f437-8f60-8798-9edbf52525ec
 13 96aa708f-45ce-7f50-828f-6898c8d4d51d
 14 71c0dc6d-c6a6-0e00-8937-6e8c14855a7b
 15 ee930914-8fec-513e-9ef2-2c89abb090f0
 16 897763ed-a479-1cce-857a-325261e7cbed
 17 1e7d9eb8-083f-5375-8a24-e70734063b1f
 18 93445fb4-98cc-1b34-afa2-2032444c15df
 19 1f2186d8-c94d-617e-b0e3-9c45583060ab
 20 b1c534f3-05ca-8a9b-9c99-daa9684f3e79
 21 b7271e06-2edc-54d0-a753-1bff1d6389bc
 22 07fc9bc5-a309-617b-a129-ac69911f8d39
 23 30b64f9c-af8a-74d4-b302-0a5875c2099f
 24 02f6624e-8202-3715-a2ed-d3a0715042c7
 25 668a6b18-cdeb-1ff0-8769-c83315bdec9d
 26 8bf04ac8-0489-104f-b01f-9c0aaef522ea
 27 8adb76e5-6ae0-272e-80cd-e3cfe5a1d0ba
 28 f0efbb4b-a219-545b-a16b-6647045cb859
 29 21dda866-fa74-0496-800a-56b22af6c6f6
 30 bcd2fc25-f34b-0fd1-aa09-8cf0c52ec024
 31 46559bdb-019c-70fa-b577-a6d4f6e55f76
 32 f7dad429-f62e-34c1-a030-ad1a18df8954
 33 7660b355-52f0-84b1-b090-fe370ee3c7dd
 34 c537f7ce-f540-605f-9d5a-15b7a80b6cd5
 35 2a587d6b-b9d6-82b4-9dab-0d52588ad37d
 36 f8ba27e0-8d51-6582-b5f2-fb60d6367dae

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 676172155538705151685673112500738686. Exactly this sequence comes out of new Random(668).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Conclusion. Filler. The GUIDs are fully explained by the mask-digit RNG; no count stream is placed for this post.

Related

Findings: Companion account · Mask digit · Count RNG & runs