A858DE45F56D9BC9 archive

201209241221 10dilc

explained decrypted filler

3DES(name+title) ECB, 36 GUIDs, seed 254

Metadata

Post ID
10dilc
Title
201209241221 → 2012-09-24 12:21 on A858's clock
Posted (UTC)
2012-09-24 03:21:17
Timezone
UTC+9 · title 12:21 against posted 03:21 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209241221) = d6b05fc60c2000c4548403d99c0abce7 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
36
Filler GUID seed
new Random(254).Next(9) ✓ verified
Run
Run 34 (seed 83,105,000) (seed)
Draw
157 · predicted N = 36 ✓
Machine boot
2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4319736CFB5CB5CB C06E292B493D72CE 61AF75A46CFD4A65 5446B18B58BDF3CD DD36B750B6EA0596 3AB04797633164C1 327D5C17B038FDD7 B6253ABEEB14EC6B DCD5342B2B000B9F 50E9A9C94CC17DA3 2784AFBEE03022CB A8D92BE56A7C6883 834FCF5A4DCD127C F1C29D176A183EE4 152CD685F0A0A46B 5F7B1DB3E1E84717 9C16192260A3E298 49254BEBBF545316 7E7E8BCE6EE762EB 8F31A8DCA32F6207 622E6323497FC2E6 2ABBD84E62664CE9 C4B5A696E6328ECB 051D241D495116AD D093D3A022362691 4CE2723B63A6820F 3808EA2B001F6D19 A90BAD32279A464C 4F633E9A35F4BB0B F49666FDD05F7C6F 52AAC51698489947 375252A36E77252D E8CBA84E23B60396 EEA40E0F77FFA2EA 173811EDC7B9A077 7CB62811EDBD0AFD 063CD4BE0D8839A5 A86C560E9417D641 ABD8527EBF974D4E 8A16144657B733A7 F2F4FCD41577754B CFF3F7188B2E5C19 D9EA17B42789CC58 23AA1CA2B4E65B26 39508FFBA6AEB8B9 F048D5BE1DED4A36 51004B87B77158E5 71767B4392AF2316 7D48C9FC48EFB74F 044BA8C56F57D00F 0A38A9B60F65EAD2 6308AB21E7E6ED6F 834E8D1D9B07FFB7 FFE3E631A0A52996 BC58AFE1F97667C6 E8AA33E4BE361DD3 FA51877094E3819D 488DC6C4AC808F28 9A201F9AFCC3719D C1F253C3B097318B 5956492B7D2EF21E 2C5DA1FE69018C56 E26D1C76AF0F3F8B 2D679053A1CB0BDD EC9B87F0A60B440A 94E9E0A5555DFF2E 987E9B870B6B1268 E05346DF4CDFA9BE 79C42EE87160A433 A8512854A6A8F14E 6EBF3A0487F4ED06 C6948776D795B2B1 7E60956F1513BB88 2D154F9618F57772 6292EB8C48F27902 0A9D6230A27F0FBA 9A16D8C76B237329 B98C70B273B0CC43 02E7038003EB5198 D8FD53694F7D5D71 F4FEAA05A54B7A6A 033023D15725FE93 8F41AF9A0BA0E33D E6CD195560E7E95D 795652554C03BC78 1222EFA11BDADA76 E71E34F2B3002420 696B7E9C248C2E99 77C1502139DD1637 70E5528425936DF9 80F704CB3786A1AC 1A523C0760345A53 2F7F1A6E691F6518 DE312F303181E41C 99FEB7339B2F0C25 208D0F25EF8F322E 5586DDE544A3CFAD 50DBD02BFA5926D0 43323A24B12A2C9C E3A92DA69EF3675D C87059C77E50493A 92428132A2A457E2 2F2EA713856E7056 ADC8556C294F4ABC 02E870BF8D284DF0 D3C5434B06254F96 A494F06E42E3CC07 21421ADCD911AE86 5CD66318A4B05B9F 7E3C8761B47CDAE2 BB72C55E133CAEA8 727CDED955D0E7F9 EA7B21AD06A02DB3 693A1741A8149CCB F42803C0A8197F3F 16160F59BB7C4F53 4AE55003F5A717AC 0FF7FD9A60A6B49A AF708898385FD1D7 2908AD2B9DA4D13A 62C13A84998F66EE 6A48A6757CA46D4C E29B5ACF3830E9C4 A3D34A20DC225F94 77EC9897DF0F7DA2 5937CED169DE4411 3454E7BF534A3FC5 2DECCE3E5479B158 118452266F8036C6 3FA5117D5D7DE5AD 87C4B423E30901F9 7BD54E87D51014BC DC80A6FE298D1738 FB13E857E7D83F78 04853F24E233126D 668B38F9D14DBBE7 818C894CD1130634 5B166F219CFF5F27 6105EE1E15E37D6F FFA4A96F27ABB3BE 2CBE4C48C09EC6C0 31AA8C291933FFCF 6AE9F6AC47D0EC63 28E945EBD36199DE C02BBCB6409E43D6
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209241221 (name+title). Key = MD5(password) = d6b05fc60c2000c4548403d99c0abce7, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 801940ab-ef85-3181-a034-50ca611bf52b
  2 fb21df5c-eb6e-339f-a91b-6840b61d9dbb
  3 b560d624-ea1f-2dce-b811-401f03449930
  4 bc10effb-9f26-6302-a725-16e1211b91c0
  5 e6e0e7e4-9746-7212-b64e-0783d2039f4e
  6 19b7d9f5-3e8c-4a43-aaf9-697e8b833b8e
  7 063f8cbc-a1b3-63bd-9533-bdf5db590b39
  8 5960e67c-7369-7c9f-933b-c3fdccea7cb6
  9 184f74de-312e-3111-a248-26c5945b40c8
 10 90189929-d334-84ef-821b-e6612fbfe9db
 11 a92028f0-5301-3d52-bd21-984070ae9deb
 12 55dea156-478e-6e7a-9133-29530e99e2a4
 13 338b5b60-b5f5-2e61-9458-259b69a1a5dd
 14 911292f5-8c30-5c8e-8f0d-d311ee0c708e
 15 25798610-1a0f-68cd-85cf-7c21f34bb4cb
 16 208141a1-127a-5303-8f19-0aa8d69cf557
 17 c7ebbdb0-3d45-5d58-9022-414f5ca21f67
 18 a012c0d7-1f91-4a32-82a0-cb532470a842
 19 7dc93d69-5c9a-434f-b13e-7a2c07eaf065
 20 5df60815-7a39-5df6-9860-e9ed2c03f984
 21 d422a78a-c99e-58a9-a3ba-2a5cfebf7c36
 22 64f82d34-ddd7-1235-abda-53f762492f6f
 23 f64a2f7a-c895-8786-9ab1-a0460a92107e
 24 31d6ffcf-0ce1-6a28-b8a1-fc5fe71e2e45
 25 37f0bed9-fccb-50ce-ace6-254350788107
 26 62cd3310-fb40-8115-8dbf-5bf8ca821e60
 27 f6ce64c2-de3f-20b3-b8b2-4443ded8f5e7
 28 fc882f2a-478f-0526-b56f-8f000ba0e4df
 29 b4b987b4-fd9a-6050-892e-168b2234840b
 30 933b3d03-1ef4-5f7a-a698-cc5c8c688d3c
 31 0550bcd1-29f5-8c18-aebf-ec6a82ecf112
 32 88cae50d-4525-3493-aa00-4957ae1e7ad1
 33 f9687f2d-ada4-3121-a704-0c45729dab86
 34 f0efb15b-2a0d-37a8-aeef-948a42bb555a
 35 bcea3ad5-cc9e-3564-8d28-0de639fafef5
 36 64be04f3-5558-67f6-bc21-17015d740760

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 332674673836256554455186582065833336. Exactly this sequence comes out of new Random(254).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 157 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results