A858DE45F56D9BC9 archive

201209200559 105mfb

explained decrypted filler

seed 865

Metadata

Post ID
105mfb
Title
201209200559 → 2012-09-20 05:59 on A858's clock
Posted (UTC)
2012-09-19 21:00:01
Timezone
UTC+9 · title 05:59 against posted 21:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209200559) = c46686fb6c9e6acfdfc4ebb5670ef199 (name+title)
GUIDs
37
Filler GUID seed
new Random(865).Next(9) ✓ verified
Run
Run 32 (seed 945,377,703) (seed)
Draw
1 · predicted N = 37 ✓
Machine boot
2012-09-08 22:08–22:23 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6D19EDD8CB800B99 EF78FAAB70B3D0F4 F8CF02F0F1DC47BD 314788612ADCA297 5EC4098EA2EED553 795CED9A8DC2EA9A 544A4FF49C116E56 DA0CEEDD99497838 43C98ED2182DA7C6 11A7179A805101B9 60740F3C61AF7A21 A96ACBF33E41D8B4 376658D05DDA6542 023CE50FE8AACFAA A698B0A2091FB1AC D83E89097401BBD3 2D8F06C8E06B1D4D 7CAD60C13BDDB121 71626CDA2AFF7158 7F65DF4250436BDA 71FC402BEF767349 4104B343924C7C50 7D277C4BED0F0638 ABF4ADE806616C6E 6B16C9A6EE40CD80 997593EFA288F714 5786D1A9644CCCF6 CE6DD49B440C67E9 7B8A126170C59DC0 D5F7E46B3D75B669 1BE0EB0F07E2D547 B18EA442455A6B5F 51FCEE76266A6BE5 F6C5BB6EFBC2A819 6D7918267CF5E3AA 64F34A3D63633A0F 75E43250A0D6327A 88DEECB1EC8BB104 7B2933C4A0C554FF C4CC9DB82E1D9293 72B44CCA03D09FE3 D7562D0570693361 EEDEFECB6F454E43 C8D865C30FDEEE4A D76F9195CF514A2F 781EE82CF91322E6 FBD6DEAE4AC600F7 1D8D00CE4066232F F1AF569115BA382E 35E22503547845AA 230E1BC1647D9368 F66F89CF80C78295 8ED180414E511801 AEC3206F68CB7727 8C01B1772B626D73 CD45FA6C8C66D2FB 78367B77A7645F75 E26A17142AF05D8B 526F5A51A047A0A7 ADA92C2149711D38 7A01B5661AC5FA4E 6BB697D86F97BAC4 4FDACBB5ED3C18E5 F777E3810D497B2A 73B972C2CF201717 B42C2FC5E11C48EE F05307C4C52D88E9 35AB2F870A30016B 12BD35DBAF6B5335 0A3232697D8C886E EC3EEEE2164F6CE9 4642F766606E467C A9C8A912455F431A 2F76478F72E34088 F4CADEF30B6CE8AA 24FD8188E94D1202 1110BA20EFCFD35C 820FBA9C5EEB9922 761CC1D84173EF52 4FF703BD047D4747 15CA9FBD990293B9 94D9E5E8972BA921 83B9CA0841101D59 87D4F3080B5F0CC4 E458A77F8A763564 B665AC1435D1B168 00FB116D952ED0C8 62100CE812083144 9921C301FCFFE541 0CC68FF43C1C6A6D 7F16E2589C455A47 4F9E3B074AE498C0 96172A9F7B8B9EF1 4E4CF14C49B74F29 239B5A736D50BB4B 75A3318165BB232D 39738EB1537A540B FDA1D4D24157DC2C 5AD754534D8C4722 47164BD0E2045B2F 8C6275A1173C0AF2 1CBA0C09344385BD 0B46887E98C583CE C1C431ED7E5E307B DF0AA565FD59ADEA 9B7970C15E91ABA7 39462F170BB453D0 16548F97ED8B6EBB 69D1EFE3EEA4D47A C7EF8889D9186D9D F9F2722A4DEDDDBC D7CCAD9C5756BF78 B48FB0C666D4767A 74B24B08A61DA79F 696FDA07DDC0C22E 22EEE32517FD4037 EBF1EFDDB25FE71A E11B6E2F8B909520 FFD124C6F4C80F85 9F976E15BE491CA1 E1DB0DE51685CBB0 D54246A6D421CCF9 85994B18FCE8C555 28F311C9BE067142 54A7D3BC1F02F955 361EBC2D632F9C10 7F10F2A386358D59 F7193663DBE07501 81CF8DBF74284922 BB4F814663F9063E 3504F8ED3E9F9759 E52008A6E6269AC7 6F0B283297514255 9AB2763B2A1688E5 E216918C6B917BFE 88583F673019599D 21C0DAB82E2CAB71 6726BDA7DC459E63 991B6F0CC0FB738D BEA117F74E6A2C23 C078AF582C49FBC5 0FB351B72D279C9C 72AF94778F815B67 9ACAA9C1C3546425 9CD53AD7DBD33DF4 AEE5DAAD19DCBA62 F3814E445464DCAD 71E9FD0F2DDE97AC 3429A55C655F90E0
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209200559 (name+title). Key = MD5(password) = c46686fb6c9e6acfdfc4ebb5670ef199, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ca1e908b-2e8c-5212-89b3-2b063c03c624
  2 577a412b-f9a5-58e2-9550-17de4f5d617d
  3 2c4cb389-5efa-3a48-bd9a-013271178111
  4 e97a0923-3a22-1fce-bb0f-25d172709e7f
  5 17d58afb-b3ff-608a-9c60-62000390c527
  6 dfa042f5-5f5d-4a31-9f37-da85ec6616c4
  7 19b6e5a3-9536-4ef2-b71c-3651ff3dc1a0
  8 bcd8ccc4-42c4-3aec-8d00-1745fe229b28
  9 9686740f-c82c-8274-82fe-616e301e6d17
 10 1ee88438-d90b-2307-b872-af9d74644f75
 11 5022e63d-ad4c-5980-83fb-d498ce4a3c48
 12 19b0e77d-461d-71d4-a5b1-e37c9d938e3f
 13 955fd035-1cb5-2187-9123-3bfd7089fe94
 14 3c746ac9-3867-457c-8644-bf23204091f7
 15 ae7af7be-7b43-43ab-a9f9-1d46e3e67d57
 16 8208fbe1-b197-24db-b50f-084fdac6461e
 17 693ea517-c966-402b-8657-63f72a7cd297
 18 f1ff2956-a2c0-24b5-88bf-f21544036708
 19 b957eff8-8740-0a6d-8884-6f0302c92c8b
 20 059c0d95-b968-2260-be6c-31b973a66106
 21 2e0e4919-b4c4-6c00-aca3-f21cb84c3768
 22 db8c659b-66ff-00d2-8eb8-2bd7000a78b4
 23 5ec2aacc-ad8c-1a68-a993-8e37bb62e4e2
 24 a3275b01-3a72-1212-b6e5-62ec87fb88af
 25 1a2e1b83-9420-45a2-9560-bec4a4f28eff
 26 d72a1d8b-da02-7e06-95c0-604ea577831b
 27 407753a8-54e8-5b5c-a921-d4a569a3e7c9
 28 a4061aa6-3513-58c0-876d-9f4fd7cdfb0a
 29 8a22bd55-34a8-44b1-ba2d-bb4b09fc145a
 30 5fa2c8ee-6c25-6041-8959-337a2a54a86f
 31 04906552-d2a9-4ea6-b7a4-67111e2e5c9e
 32 a4b3af75-a5d0-25a0-9a6e-8b79433089a1
 33 f58f601e-3b8f-18ea-8c86-2cb77a04705d
 34 7cc9dd10-471a-6ded-bee4-56e2e3799abc
 35 8c424feb-f31b-61a7-b095-37938a24b5eb
 36 8ef02bae-b291-25d7-a3aa-8b4e58ae5554
 37 71d6c652-26d1-4f50-980a-43461d0ad152

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5531644382572442420260114755464216624. Exactly this sequence comes out of new Random(865).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 32 (seed 945,377,703): new Random(945377703), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-08 22:08–22:23).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs