A858DE45F56D9BC9 archive

201209241206 10dhq8

explained decrypted filler

3DES(name+title) ECB, 36 GUIDs, seed 377

Metadata

Post ID
10dhq8
Title
201209241206 → 2012-09-24 12:06 on A858's clock
Posted (UTC)
2012-09-24 03:06:08
Timezone
UTC+9 · title 12:06 against posted 03:06 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209241206) = f64219e1fdcae0f9490baf56e9257f1b (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
36
Filler GUID seed
new Random(377).Next(9) ✓ verified
Run
Run 34 (seed 83,105,000) (seed)
Draw
142 · predicted N = 36 ✓
Machine boot
2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

109CC47C64792840 7E1E9F1625E96C0B 80B4911B317B9E4A 6DB368E489026B3C C115104D39C8B4AD D343D5AD434F54D8 8AB757DBFDA15CB0 3D8CDF2CB5732B49 49D9AE54E25700D7 9D8EA612163BFFB9 98805ECB081D2590 2514AE82A2CC3EDB 109902AF1BCC39E5 53A7BF1F54DE6829 DEDD4302301B43C6 4AF31380B684DE7C 2989B8C90A477A0F 6F94D30AA1DF1A92 624456E45EA36FDF 94DB38DE90D34B66 2F94D30E5D56F038 A7A4E551F385F9DB 80F122FCCD5C96E4 FB8718260090C4A5 EDCC6929F3BFBC1B 71C623303F2BC17D 125F5E73D0010E54 3D30F94EB06254E4 496F3AA5DA6E7310 98207A1B66E69E68 1112E4B578C8AF57 8936124E91D20DDA C53E6092AD833FE8 F0068A746BE0FEEE 44171EF62A931355 53A731947DB84D4D 4305663B7C46D303 BC7605D428675BF6 AC7FCEF39E22FBD0 34D10FC574FE0403 3CEB1F159023AAE0 3FD21106937222EB 1FFDAD7565AFF989 FF46DB68D8E44A47 E582C9EE4BCD0FC3 75C356324F063819 EEF39FC493EAB2A5 9459CF8C5D840318 BAC73D462C84FCB0 63A4294BEED30DA1 FEDBA8458F90BADE 0E4DAE920EDBC283 0B9EE5F4FE8D1BC5 F8986904BD3608B4 98A12B6821730915 34178C3B9442E71A 1A11C90123888264 DC79CFB92DC06C5E 9A9CE3AF7C2C1D66 24C0AB89A18BAE68 4B5D79A0003A2962 B523580B0B0AE823 F000CD114A78AC54 CDAD630759955FCE A0586ED8EC8E36B3 B5D21BDB91C9C489 7AB79028E045CBE9 22B43CE54992C5AA 233969D37B37DF22 BE181897043684D0 B308AF1D8BEE104F 621E1F3E01FDCCAF CCE116FB201D12F2 E6F32D49693B344C 37C85311D9FF81BD 5BD30509689856E7 70D8CC5AB6D702C6 4A04561B44305966 A1871D042609037D A955AF50E6CCFB4A F895834276C15E8F 774B4809014CBEE0 79671BE973307B1E A8A6AB813BB3CC3A 908912454EF1ED2C 02CFE774A5B4A6B3 065132297B0C5771 F2031FE32DB68862 80978513BE49BFE0 C248F1523B5AEC00 79B27C5785A0CC55 510D789462ED0A44 C8305BF502B24A1E 7E66A9506D0FAAC6 D0A0DE7C1158EBF2 3254ADAF27B9C813 0CA4CFE2D43F33CD CEB06D0851ADBF03 1AFD09FBCBD60953 EF7A33A5E7F3A3C2 04CA5C08A315E2A3 3BB2E2F1ACCC89EC 4A2D43D67DB30C77 26A4EF47047AFE14 989F1DC5132D6013 4D1E23CD6B7DC0EC E692B0494EC285A2 4A7788B32E802ED8 61C3234E8D76746D 7744A45AC932CCF7 82BB721C4EFF3ACF 52C59518F2A0FA95 BD848D24A1D82FA6 09EFE38007061A23 F1ED30C81022307D D1DCC63828096228 85C845F3EE82C148 9FD6608BF211259A 259E660ED4D6924C 0116D2E260EF902E C6CCA82DCFB6C7A1 F0F58C1C29FAAF77 11B82A1360B4E644 4A6261238D7B4C55 82CCD00610DEA730 94459D26BF21E974 A2A3B750B9B51DAC 804E864A02BF4231 5A77D2655BA7E877 FDBA9E0375E1C7DE BD835DE039453E4F 8759AB935290676C B84D97051E25AFC6 C66525C36DB876A4 4E3D469DCF7638D2 F86A0EC4F8F17F4A 048F284FF17D0268 DA37BC392A4D349C 7D0EC67E872193E4 81115915D0DB24DD 2514D19A820EEB14 DCD9099AF9076F05 85344F160EE9FA67 3DCD6FEDB39319B0 9E66BAA7FDD0C7F4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209241206 (name+title). Key = MD5(password) = f64219e1fdcae0f9490baf56e9257f1b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5bcdb538-de7f-6c2c-89cd-d225fd9c940d
  2 19ec1ec7-4a6a-324c-87b2-7212cbe86864
  3 ad45ca99-e002-2925-a975-dd7893e57969
  4 54423e05-316a-0273-85da-08bffc29e7d9
  5 1d3b8400-be11-302e-9e41-9f1dcb1da91b
  6 a504a167-3a22-0956-9cb9-abd6c5bdc225
  7 d380c94a-20b2-7899-ac57-ada0c2585d63
  8 b46f8264-9c73-530b-bdb4-0686ed080765
  9 e217ec49-e16e-5005-91cd-20f98b61fec1
 10 9bf49b7b-9249-21b4-a56d-5f3288e9f583
 11 3dc5dba5-a1d2-0878-ab3c-82739307883d
 12 610e4dea-0ffe-7dc8-98cf-5478a89d0338
 13 489a88f9-4e62-7353-822d-3a3e296e1ab1
 14 eee44fb7-38ca-500a-8814-90aae465e123
 15 e2cb69f2-b80b-7030-863a-f2ad8898d43e
 16 6bf052f5-0729-43ec-9d54-400315d6ec91
 17 2bebf152-8bc4-30b6-aa36-5cba4f2d4078
 18 b5c7569c-adb1-66e7-a1fd-0f100cdf6def
 19 b9629071-b18b-7877-a372-6d0d51c5823c
 20 e74d8618-0770-2ca9-a0a1-4d1993cd777a
 21 446bb592-6daf-8a94-b90f-f4fbdc0fcdae
 22 f0f2fe12-8cc2-35be-ade6-e35a961c2f19
 23 4d441122-024c-68d9-98dc-4c91a61494b9
 24 b09a9e59-b82a-6050-94c2-86f9f8c896ae
 25 fa3df4c6-64e4-52d6-bd8e-71643489c111
 26 b198fbed-c54f-073e-b9f2-196ad976bfc4
 27 083f0dc4-d6fc-0659-a89e-40b5ed7c6aae
 28 5a5cecb8-eb69-25c5-8325-027b3342c1e9
 29 97d630f5-d4cf-6834-b632-fb12da80f01f
 30 4053159f-b53c-6308-823a-4b63cd184168
 31 ec0db5bb-f2af-3e7f-92a2-4b144ba693d5
 32 3704c92f-2c9f-66a2-a681-1b775138dd77
 33 924072ef-3e37-8173-b624-59f1feb0187f
 34 4d1f99c0-7974-366b-b493-a8f249f3ecf5
 35 1fbfe230-ec75-2fae-99b6-64eaebba4b35
 36 c57899a7-4440-0c13-b0d5-bd82936fdc63

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 632030755207757436728366500266368320. Exactly this sequence comes out of new Random(377).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 142 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results