A858DE45F56D9BC9 archive

201209231306 10cip6

explained decrypted filler

3DES(name+title) ECB, 37 GUIDs, seed 596

Metadata

Post ID
10cip6
Title
201209231306 → 2012-09-23 13:06 on A858's clock
Posted (UTC)
2012-09-23 17:06:09
Timezone
UTC−4 · title 13:06 against posted 17:06 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209231306) = 67c0daa3bb7eb15c2f72758821c759b5 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(596).Next(9) ✓ verified
Run
Run 34 (seed 83,105,000) (seed)
Draw
24 · predicted N = 37 ✓
Machine boot
2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1563C9F0D68308AE DFAA68D8C139D37B 0BE0B86697E01CB7 C90CB96C6ACEB9B9 964F7E33E14CA5DD DAC53E3DDC7121F2 E2D4E77BAAA49686 ECD60B8FF73B1FC9 2E09E1F295D34C26 6EBACE7F9CCD79A0 97A4BB391ECE5A54 4E889BF29AE85FAA 194A8766E1D918CB C4B024B7DA51CAB6 1EF2CE6A04B7DE30 EEB37BAE1C772B1C D6B6AE4648B2CDF6 8FA8DC0C9D18F0D3 C16CBE89BF56BD69 4A6970CDA9393E18 E2752639E4D64819 DAF5C9F40593E11D 60B73768E13B45F0 6FD89F268F96F287 5F4C80872E9CD2D4 1FEFE9A3524E272E A071875F6A6A4D5E 556FCEF6943C9639 4BE625E6F32E22A6 40C8480D20F6DEDC 7B48E29C1A3C006B AAA811058D070D64 8E7FED3FB65EC13B 8B25296D85A5EB95 01D6E0A0EA9D0964 FDA956FB3E8D08D6 615AD81AF2CB2F29 65942D03D1AD2A49 D3D6D077653FDD6F 45782CC03DCF0A97 E23D117643A4D5BE 2D7C621924377DDE 232315322E698744 904EA016E7E603DF A0F5EC835DF0A94F ACDED971A1F13E4B 9F16A18ED9940F00 A761871861AB1619 FEC89A3700C77E24 247857F2C698498A AB05A37DF50EDECE D9715A5AFA543F22 11797A2617EAEA7E 589EF5E4D446E27E CFB956FC1078C00A 037F801BCAD40BBD 2C58BAB6753A47AE 996FFA66EB7CF52C 5404ECE17C4D37B2 1182E72CCDC22223 BEE959D2B3EDCD44 486317537E76C0AC B7E46D0F6BF7D9D9 69E6470F8E5ED7EB DC67350BC99FC06B D9D67F2504F3AD93 94CC7E4722A6F85B 3B387543A78D9CDE 2B7987282206750C 9ABBC21D8A6BD0C7 0191BCC8D75A52C9 2B3336C3596BC6AB EC1D3EE6E3A1075B 8207D0A27D81A295 FF455FA154D97AF5 AE1859B28C3FFBFF 765127E24613C97A C48D6C6072135BA8 1BA0EF944A1813E0 11C1338BB1CE5EF7 6AF0E5C0D9E536F1 10C675E31687A41C 8A8A1A92C94A1628 D3B391163F460D11 AA238C4D679A999E C81EC64FE61AFA2E F5D626B901E1E17C 7588E0608CE854F8 0783BB9F6845B1AE 4BC0389596F271E4 FA7D4607DC37C1C8 897B38BBE0661116 C0E8FB4A479F79E6 6384B741602130F2 7A4181497A196C85 7A2391AC7A16564A 64EDCA8F5AE927CD DC6B33CC1009A702 86D6A8892EB1752C 6A2A6503159CAC0F 102704C753B14231 3549AED09511F878 66B09DE0D22CF589 A903C9A2E9F52DE9 4B19B71416DA1523 CCFFB48FA48AA017 A7F7C56F60A10DE4 2551AF7A49EABB62 C018CF5FD6DF13EA 3B203047C90E4A8D 7F6C809DE306A07A AA21CB53B718E96F 85ADAC3414E3DA8C 99526C304FDF18B5 ABACD5D98130FAF8 A6D420B7B81A9210 807E864E1BAC96C8 149DBEA40165094E EF3BFE6626A2F9CD AB8563CB04EDC78D 9159CED80DA09904 5D1B70B1761DD374 1CFAA963CDCC3840 734AFA25B6C0F5CE C521318BD817B7B3 4ED4102D14DF180B 6A61163D1D3F015E 414A2C20A0998023 1833F18A95787B5C 2D21874D75370A2C 35B6745F7330FCC8 8E9751DF7C5B7EBB 547C774EE947ACDD 03D5A2FCF08291A0 5B29B5B4E0B912F3 3C8A582A1C20FDDA 7134C6ECA807608D 9AEDC4298145D3EB 7E2C0A2680F39ED1 A4F73076648306E7 A27C8C8DC6F3755F 2E7BA67DEDB25657 3E33432CE5D43BA1 597E1299C85A2EB5 0485C5097884967A F229FC2C02972078 3D118FCA7DA12221 6720E9A287C54387 45DE3BDFC171F941
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209231306 (name+title). Key = MD5(password) = 67c0daa3bb7eb15c2f72758821c759b5, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0c67d70d-acb8-0c71-8351-ef9c5ac06082
  2 a87269bb-7409-6838-be39-402e2faf1c6f
  3 16831a3d-d802-3c11-88ce-999d935167f5
  4 7bf82f15-2570-624e-9ce1-125f5e3a7090
  5 26cb7be5-d17f-2164-898d-a0cb0cf71028
  6 d807233d-3771-3ab8-8223-56f308dc4222
  7 b5fae2d1-35c7-81d8-99f7-6fffaedd6b07
  8 419aa9b1-02ec-44ce-a570-f043ff33eb8e
  9 b645beb7-e531-6bfc-b255-bbbc82c372ea
 10 6c191dcc-a622-0f85-b29f-4f52f4047efb
 11 b4994a68-ffed-3c0b-81af-b1babfec3e45
 12 0567b968-48f7-6999-9f8c-0f402ad22247
 13 c70ede19-68ba-3a22-a7af-250f2ddd579e
 14 86831b08-b631-4520-ac89-fe784df242f6
 15 96a8e5db-8bf7-1213-b4fc-126a79a05e2c
 16 9479f997-16a6-250f-874d-e175391e45ce
 17 ba33707e-5987-36b4-b42b-981a7fa66ad9
 18 5711411f-c360-4b8a-a468-4824a557c044
 19 2f7e1423-f629-77e0-b01d-e49c8cac653d
 20 c0bcbd69-075f-0de1-9e46-fd34f330fd5f
 21 40d57519-68d6-0564-94f1-630c8b744c6e
 22 8b1c0a8f-b10e-04a8-9b11-0097aa7f22f2
 23 73f74ae8-25c4-6fd6-9e15-d47acd44e0b3
 24 ac917a39-39fc-26b8-81b3-94f7aac9c5ae
 25 69368bbf-58b9-1549-9556-4aabc3a289e2
 26 2506d94a-dd4c-78b7-8c4c-0c576c1f3622
 27 bfbd705f-2307-3922-8b60-58eed92a91c8
 28 1c7e4d33-16e6-81e1-a7f6-52079154d6f7
 29 f81da666-1593-164a-bceb-7b39dc669565
 30 e15ba411-f97b-0bee-928d-df4a8704f1b6
 31 4f2e18de-eedb-1413-b6c2-dc88548f2a25
 32 5c02a3ce-3cc1-3e40-a88c-899f5bca65e8
 33 cb39e767-a99c-8e17-8b4a-fda22e06af2c
 34 3c319fa6-ab8f-88a0-9e88-b031b167064a
 35 70b26580-3fb1-6748-8080-00c753e5cb2a
 36 0b9032da-7fee-5454-b21e-2750ab0eb181
 37 f2d843a3-abf2-6277-82e3-fd1975a843c3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0636238460363412347000621738101388656. Exactly this sequence comes out of new Random(596).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 24 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results