A858DE45F56D9BC9 archive

201209231335 10ckb1

explained decrypted filler

3DES(name+title) ECB, 36 GUIDs, seed 490

Metadata

Post ID
10ckb1
Title
201209231335 → 2012-09-23 13:35 on A858's clock
Posted (UTC)
2012-09-23 17:35:30
Timezone
UTC−4 · title 13:35 against posted 17:35 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209231335) = 89688244fef42613a65f51859b194e50 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
36
Filler GUID seed
new Random(490).Next(9) ✓ verified
Run
Run 34 (seed 83,105,000) (seed)
Draw
53 · predicted N = 36 ✓
Machine boot
2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1434AED439060028 CE7794467F0BEFEC 5BBBC23D2204C2E7 4488581C18DBF3D0 1CC07C1DE33993FB 15C1CB02B1531B03 A0112802902BE3F3 8669C20D4E99780C C22D35353E8D3D26 5384622BACD8FE48 75CA93E127AACBBA 878A2423DFD6ABB2 EEFF52351AD3C0B1 5908D4C8A7968091 F7652395960A2C8A 1AA367EE6AA167D9 CB92EACAD0CA8D8E CBD87164CB9E3798 88EFB69A5913DE50 E0531FB81EDAF7F2 476F83D920F1BA4C E9DD73E09194736F 0187C308A6AACEB8 3743DE62C587E6F9 3A357BC5A3F997F9 64B3E377FA7248D4 17E05E80BE7A5A4B 4B10A3F6B31E3009 7E2A2086BFD271AC E213012328449B77 7BAA763F4BDB7FCA C1578FA38E5987DE 803586FA675B524B F2A284F7263F68C7 75DEFD3B0C0BEC6A 72B305F647FBE6FD 279CD1F964F99D18 EC3869640586B804 3D3D00DD9D4CEFD7 4DB2C76E3D6C5913 6BDFE0F867048033 F587ADA3BCFD5CA4 57D4C086820151BC FDC45E7475A84598 17D4EC877100C1F5 28C0054D3E54AD77 4BE8345C402ADCAE 0C7E5DA3A3A8278B 467EEB604D0B901B E995B428CED03407 B0B4D04E7B14D2D8 2D9CA485B7E0D18E 5C2B5FB15446AA9F FA588CD1B407F934 C14699783A6A2EBE 5BF715C5244B4B70 56B38941857BDB84 6AE04929EC84AC00 2D27899A327DC6F9 17D708CA1DC244A3 FCEAD4180FF86818 75662A578F5F4049 D532672155A7C6C0 9E9B6AF7512F5F06 0EC754A07E5DF0AC 12B1AF3665AC440A 15E542BE17644647 9F5E54F492C1D455 65A046EBFA732199 38D1CD3BC01DDFDD 52AB7538D6D79855 73CEF8BCEFA64C7D 8B29C7887E57961E 9F04318B2DE0627D A6D686992FAA5BBB 553654FFEF9DFCC4 5AD58A78C4C19E86 17BC68D169DF6207 E9D268770D05C92C 995352EAF8C88B62 4FA526ECE74B6F26 DC59588E885C87E5 0E21689782C95AC4 B2F46F2F02AC3A34 67280DEC99796355 DD4F5D228C25B2E4 12E192FCC17C749A 85A2B97A5F96837F 636F700D9CE1D053 BEECE18A110BDF86 55B86F0F37CEFC19 B5CBEA8D7A262F66 91C1E30EB658DE2D 8BB22364B3BA9F23 31951753621CB35E 0E6D97A9578AB475 C8D21B51182432B4 DDB57297844DA4B0 8A050763DBF233DB 352CF7F1D449384E 81237540354C4B92 13B0C02AC750B5DB 07176702B18B0AF5 31E9ADEBAB335072 8D75270DEA66E112 FDC3AD15887EADC4 A61458C05B07F97B AABA31C3AD663474 8304073732825F20 5CA1F04CD9718D60 443953CA8748CF37 41B3DFE59621EF7C E7C7212458EB7C4E C49A7BB4627F60A2 E73A20DE73A62E74 27974FE368D059CA D331F0F349D0CE8A 2D7D18E83B678CCC 61E03E7AD933BDC6 1248B95C6035D399 EB037A163E05CF80 54DB039E30516058 9093121B9144EE28 29FBDE0407FA78A2 3DD62B6B6D8C1E66 A2197B22F4345A17 2B5FFC4A9FEF3422 71C4F386C34BFF5A 32FEFAA94D4D22C9 73EEB6888C4627F1 6A7645AF9A43F300 42DCC026EB894CAA 5D49E2A3F9B6B02E 77AF2BB49073EC18 3A7A24F04E2C8B7C 12E2ACEC2415DA2A 45DA038EEA1F3429 93B75581D7C2E50B D44B019C01DA17BC 4622467194E238A5 8B97BC9910B36AE4 5BCFB69EC732E347 079D54F3AC13DAB1 0145372C85C4A8EE 942374661693D342
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209231335 (name+title). Key = MD5(password) = 89688244fef42613a65f51859b194e50, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ef88738e-22fc-6f05-bb37-2839ba86849d
  2 e506a6af-23e2-5561-866c-9c82e14ad184
  3 9ea7aba9-ea3d-2fc4-8831-dcd90a2ccbfe
  4 c9294e37-2699-1d41-aabc-b0c79bba8906
  5 73c0a986-90b4-358b-8bb1-486ebf962282
  6 188b6d62-6f30-6d0c-92c6-47f3ee9bcd3d
  7 c4bc80fe-bda9-4798-a78f-4365f40f56fd
  8 483ae4bc-9572-24af-aaf7-0da0faac8212
  9 5a3774a1-4a61-5e0f-af74-562f0d03d0c7
 10 293f258f-1ab7-8686-8f31-de4271ab36bb
 11 689af3f2-1cfc-253a-bb0b-6f92fe8296e5
 12 ce76c1fa-84cb-07b3-9913-ecd677399992
 13 3cefb4b2-56f8-407d-84e8-f6996742682f
 14 98bf96a1-e1fd-38ac-ba5f-2cd1192f28da
 15 3db1ce50-4485-868a-a889-dc685f2d2957
 16 0e579192-453f-0ad8-ba85-7c775662845a
 17 121f6541-db71-7c3f-b809-4c108734b1c5
 18 3e4df088-9269-7bd0-89a1-b5b97b1f0371
 19 9950f45e-24e0-8221-9b45-8ee20c2c9909
 20 c48dccf2-7947-0d37-9e2e-1d338154128e
 21 f34d1f20-1639-896f-accf-641a08404f51
 22 9e26a8ce-76ff-099b-9cf3-e8279c348100
 23 a8703ba0-3a02-7c84-a14c-35e0e7e7fbd7
 24 4e4ebfe7-ef8a-16e1-9e15-12dcca073513
 25 27d13906-35c3-6ce0-9f9b-58ac17149ba6
 26 e883cfda-7c59-6f8b-b2e9-eee6c29e36e9
 27 6f49cce0-81fb-1877-8761-87938be4c72a
 28 b53fcea7-ebbc-2812-b806-f91d8e87af5b
 29 aaeaad97-098a-84a5-bf94-ba7397d3e5a2
 30 db2d1ef9-7b5c-6447-87a5-fe3ea78f9036
 31 c396d8bb-be5b-0ed1-aba7-95e249c392d2
 32 1219b698-5747-477f-a3f3-90b7dde6bf7e
 33 ce225842-7d6f-35c2-af11-2ff312bc8eda
 34 6fdd01c5-4c97-2784-95cd-8d13023ed23d
 35 dabac902-e2cb-6791-a568-ff995310840a
 36 89d6ea97-a12c-8e0b-bba1-2915c947a548

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 652136425820438077808071661286043268. Exactly this sequence comes out of new Random(490).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 53 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results