A858DE45F56D9BC9 archive

201209200715 105rca

explained decrypted filler

seed 280

Metadata

Post ID
105rca
Title
201209200715 → 2012-09-20 07:15 on A858's clock
Posted (UTC)
2012-09-19 22:15:06
Timezone
UTC+9 · title 07:15 against posted 22:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,256 hex characters · 1,128 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209200715) = 81ea8c72cb516baa0b03096225ee3cf7 (name+title)
GUIDs
35
Filler GUID seed
new Random(280).Next(9) ✓ verified
Run
Run 32 (seed 945,377,703) (seed)
Draw
6 · predicted N = 35 ✓
Machine boot
2012-09-08 22:08–22:23 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

68B753B98DE2F6B9 AAC75B75A02C8ABD DC566599A644C2AB 16E910EEF4C6FEDC 28C2A7FF40CC0D55 CDEC56DE451CD0C3 A969046AC941DEEB 3969F07A09F76929 35DC596E1E26CB74 A5B1E4288F2DC14D 7437B51D535C6F1F 0B3FA58066A121F7 FC5BEE4E99B9D702 1DCF211648DE6E89 84A3F7475E05C963 FFD42F1A673E5E70 D64642CEACB9DB6E 4CB21C730BFB44B4 2DDF2CB2982E3501 108E71914D8319AD FAB011EB1C8CF503 0080F48D4642C756 D065E090B49B1B96 981CD21D995A03F9 45D047213D6BA278 35BD7CBBE8F1BB02 0C9D7359FE2CDD27 44F078096C491E8C AD7D857E9912F800 7304A76C64F02C3B DC7049C7E2981F9F 8DE55805B18D6B4B 0C9950B15094C257 36E36B70139DB215 FFD5287A1530DC9D 3E5623E523D13CB4 259BA9F574300201 D703D08CF79F91CA 20909FA4BC854DFC 4E20C2EA63AEDD70 DC5B8638B7AE43F9 C51199B16CA51987 255586D233A22A0C E3392DA95699A7E1 B53D072429B51E95 9342481E8479F2B0 EB5EE5C83F99FAEA B9F42AA64650138E E38362D466813A74 EA4185974E0409EB 939A35D5A82725AE C524F56AC90E642F DADB07A461802529 19D271BF0469B977 B0B673F173CDE3BE 979575D4276EBC34 E5BC98ADCA0C4CD4 F201BE5C9A0D5E2E DA984A319EF08926 BFC28CA3E531EEDD EC917809410F89D0 D5EE071C6E13A8D6 2A236BFC653378EB EC227B3EC6236D11 03BDECC00B2877DA EDB27AEBA35FAEA7 49C3597E081327C9 50F76D3E0E8B5699 0ADA3806A130F92F 2FF6C9F312F1AB62 5F71F296A4CBBD67 ABAE473490B507CA 162B0F9D81B58554 11C4CA94BEC0F6FA 23A3515A24216877 FF2370B5419E7B01 888EEFD613D3E78A 1CFBD6C0E1B357F2 476716DE963DC90B E61753A5E86DD7A3 F92BB888EE842FCD 2AB5D4323968FA44 73B2306C0CAD45D6 CC63DC1611BA2AC6 F41BA63244B06483 077D1F9B16E8B35A 1EFE322FDADC5171 9E52DA1F2C6EA6E2 F52F53C863019A30 16727F994FAA24CD D02B2C98A7B01D86 233720ED58505CC0 9CF99A595106BE52 F7160BC17D486F2E CB78A813C8737C0F C351A2526C697048 4A8988B615E9B5E5 5CBBA12B759C68F7 C6B86FCB5AA717FE 7148A72EB15B0518 16CE7A2C1F2EE7F9 534D3EF311FAA087 DAF736010571B88A EA53D4A4CAC4E7A5 7B2432166C019496 D84F7DC31901F41B C297F91D765AF3F9 CA7A5551944CDF44 7A4D4A9B8DE1C49B 5A4085664815A469 3F831422C61BA2ED 4A1F2ACF0315C1A6 D17C977099E14913 5590723EFC3D7215 F484C1766C1AF21B EE356BF74661692B DAE8CE16A10692AE 1091CD14984EFD75 F759DF1C3982C53F EBAB95260EAC6925 097660AD1002CADF 17BD1B6A9BF16757 B9CF92D38EEEF5CE 1FC14A315B3D3CE5 9BDF5DEA4A807FBA 72D28F85D8DA5E46 C656EA3364BAB66D 98F51BBA33397B17 57627C2B5E78D363 2D3153558AB56415 A4A4E7086F76C7DD B1600FDE778B33E8 3BFD7D2FD7492C65 4931E3447D436363 3E190E4F8D1CC1DC 1F39D627D6246A6D 8FCB812C079AD462 5CCFF61B7727C483 477435BE361E564C 60ED9068C4A0D100 FD2F24278E6852E6
  • Read the ciphertext. Strip whitespace: 2,256 hex characters = 1,128 bytes = 141 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209200715 (name+title). Key = MD5(password) = 81ea8c72cb516baa0b03096225ee3cf7, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 35 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b3fc72cc-ce7a-0600-bd31-c1b29130835b
  2 1044f123-394f-8df9-9bf9-730ac37a7c22
  3 d11c81bb-9702-4398-9b28-a7c004ff4a19
  4 7268e949-e631-227e-b936-0d948e4019cc
  5 7f2c1873-0177-5c92-88e4-e30693ef1b21
  6 97e343c8-7c57-2652-bd9f-92a5980d7f29
  7 e7e13c9c-9cd7-36f8-a1e1-14c5a496b163
  8 558f0c69-c4f3-8313-bc4f-8931722215f6
  9 cc82ed43-9987-5b1d-b63a-ca1b8c60e012
 10 b19a1e14-ad4b-4742-84e1-c5f47126a676
 11 08c0d91c-0a86-50c0-94f0-b763064b5b7d
 12 4f48d513-db55-0575-83fe-122280366755
 13 d37269ba-930a-1bcc-b27a-ccffb886e496
 14 ae7fc4b0-45b7-1cdc-a0f4-f28ab6906152
 15 4b6e8e3b-d8ed-8ce7-903c-28c835ac06c1
 16 e80ab13d-eaef-8d50-82f2-b32fd6648e26
 17 11a46e5c-8213-53ac-9e67-f4b4e600eae7
 18 0af5dd38-e11a-5768-b312-6f0c87c6281c
 19 a9512f76-9d5a-2063-b682-6f030e5b2811
 20 f066c7f5-de6b-65ed-b286-ec8e57722657
 21 6c18cc02-94d5-0887-b16f-191a95e4108a
 22 82053a78-05ff-40d4-abcc-0c1c8d8d2837
 23 038d5b1e-c782-236f-a43b-a8cc7c30cf30
 24 b56d0287-1acc-77df-9cb5-206c21d24c31
 25 dd2d9189-b0f4-1d32-947e-28e5684e680f
 26 8869ffde-282f-5076-95de-99c58e612829
 27 6b498eb4-0dda-6b11-9a0a-6221a5154dc3
 28 9d509171-689e-14fa-9aa7-a29d84306084
 29 5163b3fe-c97e-7d8c-84fd-9ac79f71878a
 30 29b8aba1-020e-5065-bc3b-5c6c26fe9695
 31 0b4ed902-9587-5dd3-80aa-e3efb33f2446
 32 e9335715-f553-11f3-af73-7316f4fcfc66
 33 5489580c-da84-8ceb-a1cd-c564d43780c8
 34 b0465650-3229-0d0f-99f3-d85c77d3b4f7
 35 e8e5da47-ab46-3c0d-acc0-602d6f47ff4a

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 08425238545011885526042715617551803. Exactly this sequence comes out of new Random(280).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 6 of Run 32 (seed 945,377,703): new Random(945377703), Next(8,64) per post. The RNG predicts N = 35; the post has N = 35 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-08 22:08–22:23).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs