A858DE45F56D9BC9 archive

201209231400 10clny

explained decrypted filler

3DES(name+title) ECB, 36 GUIDs, seed 215

Metadata

Post ID
10clny
Title
201209231400 → 2012-09-23 14:00 on A858's clock
Posted (UTC)
2012-09-23 18:00:48
Timezone
UTC−4 · title 14:00 against posted 18:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209231400) = 582ee9058b24de0d39dc982adf25352a (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
36
Filler GUID seed
new Random(215).Next(9) ✓ verified
Run
Run 34 (seed 83,105,000) (seed)
Draw
78 · predicted N = 36 ✓
Machine boot
2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

D8490F14D6376BED 8A4627E95167BBBE B6C4A8CF60A7EA44 2243E43F5D690F41 F4A2342F26AB58D6 B1DDB30D0DB9879E B27465F2CE7415FF 1C9F3B8D84F32EDF 2E77BCA5486C1CEF F2F65FED0613FE25 5C9BBFF5C59AE299 5797974BF5435DF3 21F1630357309E07 7537781F245DC7C0 339C808014DCB76A 84D13A9B6E514652 A011514C61AEB142 0FD3B5835C864733 E9C0AC964E10742A 6C08E05998DCB9A0 392E2F64D4C8EBB1 32BC16F7FA522230 12DBDEFE19FB3A90 E39551E1F5917AAB C9E1E45E8A2D2833 9F2DB0807F55B6AC 2234F6EF597A0BE5 46E15527A52636DF 872FDC3E975048FF AEFC17EA07743988 02DE4A08D3E7635F A4E6386677BFF876 9D2FAE8370D96790 6565CDA219D06600 0D893E2635FB54C6 B1F5B9CE30983BD1 07EDA8149E0FB207 58B24D0513E021E5 9959B21BE0C48F4A 6BB307BAF0C44AC5 727EF3D5A633EC8B DA7347F6574C641B 6BCE07D247B9520A 6202AF0F2B95989A 163D7F9DA5DCF6EF E5C414D836C78A9A FA1670897A02593C 3D777ACC5C7D9954 5CD182E3F82D9C08 765BABA76618F25C DB97977CFC8FF4F5 DC920923D93F1F47 9B11AEE3C106C5DB 5BE2EF9BB115EEEF 509CDC85F24A3FDF 4E2F35A7F8251A97 8BA0F0EF81ADE434 CDD33B242AA943B1 EB0EBB9249622352 93A67B434B76F1E4 A39A4E95CE94212E 8F8E528096BA42D2 B4AB23306FD0FCEA 14CAAA30E803F2D8 8BEEB6B685DE6DEA 6CAD32F5BBF5E99D C4A43D62867DEADA 31AA44EDE8CC85B2 74F73BB8B0AF4915 C2BB12B9C9194AF3 D35F55BE22877AF8 976F0C5BADC258DD 1C454F59EC27AC08 C8317E12DF60D794 9049D07A1F463331 A537BD2A4C8513F5 1847A4CC36753FC1 E056B8C070BC3BDE 382C98A7D45C0D49 EB1FFF35A2155796 4EE9B14ED2942E82 048B7888A24D9C2A 7A6CF390705E02A0 6451491CC9D4E737 7A4E99FE6E4AB501 91918D2DB109502B A35ED0566F111EA9 9C1A5169630D74E8 03E3A61030ADCA62 77BD5798317FA982 FCAF5BEBFD26674C 3766BE34FAFF3E74 45DDA6224BC66940 1C16417546B0BDFD EF8C3C7F03E2ABDD 4D6AB10444BF06D1 D9A41D51693FB94C 61DDB07991856E77 7D74A5250416AE8C 2EFAEFC0145F3204 1A016CBEE2B978D4 B648429CE0C0932F 0D58DD261E0263E7 81F5DC35BAC33076 FF9865877C1ADE77 495AF35AA4F7D030 CA21A40EB5DC13B7 52B34985F3E5A4CC 49F0E41347D46B3A BEF7AECA0AA94063 903AD61EDC07F29C 2BD6A665D4C31B6A 4B0808BA2E4F7C5B F7665D76FDBA0E1F EC233821BB41CE1C 41AB00DE003DFB52 2AE458CE4A17EC51 B5B38FDE8BD9F44C 0B2B71DDD7CFB67C 819ACFC4BBC310D8 BD10DAE5D58AA0EF CCF7C5F294116741 085B0363C8E6BB33 038D4484C646CFB4 1583D9FF2F8B7BD5 EC510CF4D5243421 A4304E004056080D 2F818CD17918F471 8B8539D7F1AF012A 2B797B81EBA7931F 96D4E196BB63CFD0 78DFED1426425043 A22354E451B2186D 64C8DD5C3077E11B 6524E5E58F4D465F 0C467ED967E9A5AF C011016493765739 A08C87A2B011363C 6D865A5DE9F0A50D A8031AE10B727B83 8E011C78D0613555 A630AD2886EE541D A692130268398A7E EDE6C9D4A5884E07 8AEDB8ADB90BBAD2
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209231400 (name+title). Key = MD5(password) = 582ee9058b24de0d39dc982adf25352a, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d048896f-e962-0749-9d13-d9fab3e4938a
  2 ce0a25ba-140c-8c3b-894f-4a4143f2ce2e
  3 10f4c4f2-556a-022f-833f-a0994a406276
  4 fcae3fd3-ec8b-4fb8-8afe-36c2a0b093ed
  5 69309eb8-8de7-20f2-aa53-4d3a411284ff
  6 d4c9caa0-5dc1-4ac3-9d7e-2a7ae163d8c8
  7 a0e6ba23-c369-2733-8a29-414744846cdd
  8 3ad3886b-a287-2d7b-af5c-c652290f9889
  9 12e8e983-ac8c-5df1-8e21-3c4902b44d25
 10 2181394b-cb77-49fa-b86f-9a3b86e64af1
 11 7bf883f8-d146-6773-8dde-92972589ee56
 12 5b8991dc-4835-2b65-bed9-06938444fb3a
 13 1745c709-4640-305a-bf52-4f162f21a65a
 14 0733a9fd-642e-2acb-90ec-4764ef424516
 15 b4c7e2b5-fd35-4e38-a03c-438506f39743
 16 3421820f-9107-2a63-8e7e-3e384a0e40ab
 17 742c09f1-caba-2778-ace2-82cdc36aef54
 18 cf49f56e-013d-22e5-bf72-a535df65dd08
 19 45b7a7d5-6a64-4575-a23c-e23e40bf0168
 20 01fbf0a2-f434-5035-a70d-a2481069105f
 21 936dd958-adb3-3097-874c-4e3ccf902fa8
 22 b80d8fd4-3592-570e-8142-b1a74f60aafc
 23 94e6e35f-7bec-2c55-9147-1015cf2063b9
 24 5a9dee6c-f35e-1dff-a5a3-0e2d48869282
 25 75e8d8af-9284-6e7f-b730-410774ad61bf
 26 3c6b1b49-b344-71e8-8a3a-fcf2b45022c1
 27 061301b0-8c8e-70fe-a10a-3c4e294fe03a
 28 3eb6f6b1-af43-873c-bbb0-e6b4b51b17a7
 29 690a6ef4-27b5-8c6d-9bb9-63959f0d806f
 30 58ca3bd1-9dbc-2bcd-ba6e-00a52565c1d6
 31 f641ca02-3ff9-5ecf-bd40-110695faef99
 32 ced6b6b4-7814-0116-b201-99fe0a99dcc6
 33 30e14ca7-a5f7-653f-ad20-090d3cfa107e
 34 ed78fadb-9867-3227-ab50-2ee0b7008ecb
 35 a34c64d0-c607-6860-b174-deda20ae6e27
 36 5c245df9-4f96-0484-aff7-7879c4110b63

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 080424225462324222453521677882506360. Exactly this sequence comes out of new Random(215).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 78 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results