A858DE45F56D9BC9 archive

201209241235 10djf2

explained decrypted filler

3DES(name+title) ECB, 37 GUIDs, seed 900

Metadata

Post ID
10djf2
Title
201209241235 → 2012-09-24 12:35 on A858's clock
Posted (UTC)
2012-09-24 03:35:25
Timezone
UTC+9 · title 12:35 against posted 03:35 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209241235) = 38c98d737735298c4d66f4a7e90bb87b (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(900).Next(9) ✓ verified
Run
Run 34 (seed 83,105,000) (seed)
Draw
171 · predicted N = 37 ✓
Machine boot
2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

21E57BBFE508A07C 7FAD2C777C8452D2 9C6AEE97DA866930 E3BF5335FAABFBD3 8D10FA4EDD663A0A B871584199153171 8883F606D799C640 FDF714B65D6DF7F8 CF91934CC511937B A8E6095665E81A25 7155DEF08E7DD973 57A8E252879ACA1D 8BDABB900FC61C49 0579AF0258CB0968 2A356E826C4424A5 A5555E839A298E7C 21FF71BE38265A59 C717B2A827BDDA2A 80615767D4A4E9AA DD97F84493753816 A8918B7F335599B6 5ED486F3B0707B62 A6344104679D2F8C 5D7F59055CF5D058 5F31162430DA09BA 6183B9BCF9893B43 CA9F06D321561BF6 6E187CC1F6E05710 7B497BFA9A1FC311 D4E61A2E6892DD3F D4C689A4EC2BEB85 83CD737CE267BA15 07B3E876EB949658 7BCA678807F383CA 781733ED6E32D24D 475481E4662E998A 64DB15C8B25D1267 37B79BAD69C877D7 CFA3938FA527D3D4 FBD10738388BCFB5 D292C177CF010267 AA0F589EBE552307 B34B500259F75C9E F95D4074BE7AC507 E2C33630027550C6 6FE8B7C8D22636CC 3FF599D530888872 894097DFB4B69CCE 531B21D0B7EADAF7 B156B8131E991559 784A498B9ADC9B28 FBAC75F14BB3B63D 6365E7F6B4BB8F3A 9E9C4A2E3610B88B D9F7FB3EA269B92E 083D968CD8F9DC4D E431D32A94F373D8 B5E0D0557EE7A3D1 6971BBD35F8085C1 32EA9E3BD7EC0039 9A1C8EC50B52F9E6 86B4745EFFBBD977 9BDA482579D54206 4609DFF04AC17BCD 1B74AAAD81E471D2 2EC2E4FC4CE96F93 E052037153E9389C C180398EE987B8AC B3A34373CF50ABE2 83796A07A3937B13 C0B3DA61D98BA340 C433F0064727EBD6 200203DF21FE82DF CC715733D994214B 7DDFB15892450AF0 89F7233F87E80D07 4B61C272483D273B 22143E7BCA541DB3 2DD31C98C923D096 3814B8CFEFAFB2F9 F0B2E8355066845D B00BD6889FE47A02 BBFEE5FF9FAD76F4 EABA2DC11FB12F8B D76B8E682A76569C E6CA78337C73FAC7 549F4AD2EE8905F7 54F204F0A8C2EE83 99E45A2E3D226BAD CE023FE371BDE684 AEC45FD0171D7CDC 1D358FAB601F68AD 861F07F4A4C6A81D CD971169552CA594 8FFF5E35C3807335 053D01900B7CA935 D30423BBD767CDEC 328769399BAD0BA6 FDEDCFA455761167 446F45C44AAFB808 F08ED21CA794A60F 7C10D600F763730F C5CA6CABBA10715E 6748245A7B54D26C 022B3F383AF54E84 9F7874249365CD3C A67C11DF821CA731 798DDD7113960443 70B1269B85F86943 BCAD9FE36ED75326 C81BA080A0B29668 D57EE7DF4B7D184B D12FA8BF6749D32D E7879E973D46FEF9 D0C78B047325509E ADE018DB640A18FD 7D84C67F84D85156 BD29C7D35C4938A9 FE3B69CCE59629E3 571DF9CB4A85C107 5E3917B0BDF36E32 2261E019E6701891 E581890EEF7AA823 439F962037465E4C 56D72A799BA239A2 C5E97DFFDA178CA2 00DF38C82B004DCD 07C28AA6A664E3A6 87EFDC923AA34040 EDB4B6A792D9C422 6A6B6DFA055935A5 BF4E1FF8F5ACDE87 277569EC198B206A CBE50EDACDCE5E2B DB1952346D85BF2D 9E4D15BEE58F9547 C87492E342221807 C2F3F68D56D8B7A2 06A63D56DA52E73F 79BEA57E4C7A7A25 DFFEA8684837571A 85BA5E3436449124 86F60B071E58F1EF 2E6E5F53EF2A224E 90DD449FFBF28991 62E6521EE70CA434 EA758C8344308D3E 441941C7E685164A 12B11D235CD0E26A
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209241235 (name+title). Key = MD5(password) = 38c98d737735298c4d66f4a7e90bb87b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 715e601d-c93a-8ea3-8379-c8c71d94d5a8
  2 2ffe8ecd-0964-8ef5-9ea7-566de8e825a7
  3 3a09e67d-2a35-7ab5-a138-c4bc8cfb97d5
  4 cc78eb81-3025-55f1-af15-ae3e54b292c2
  5 6642f204-212a-4d3a-bb58-ac8af94496d3
  6 bdae03eb-af36-0d01-85ac-6cf22f94467e
  7 8ac3c1b8-fbf7-1bb1-93e1-9bfd388c7aa4
  8 13bdfe64-636e-8b22-8d7c-2402f0292a9d
  9 b83b0a5d-180a-223b-9b24-f71d350b581f
 10 068ecec3-b46f-15fd-8404-8940833516ff
 11 e1c9cce8-3962-30e0-af46-bc990849cbd0
 12 e1cb1acf-afab-0d42-8720-79af9f04da12
 13 beb77519-f3f3-37e9-95f9-93e678af1fd2
 14 28e41b78-9187-6126-8d56-a6e9d7869698
 15 552b6c63-0294-8c89-95a7-5de641c5d703
 16 c5baf7bd-2a2a-098b-b57f-d69a244b6444
 17 9768fa46-0ebe-1936-b9e9-07baf9ee1be1
 18 892e31f7-0b8d-8701-bf60-54b5e1ebecdf
 19 c0a398e5-8291-082c-bbc1-c011507a48f6
 20 95f6b22d-1d42-7ec9-a099-0a10c0617ef5
 21 bea1fe37-704f-3522-9ad5-a57da8da0445
 22 3f141aec-1746-597d-b0d4-49cdcddcd9c0
 23 df081f21-dd7f-0ef8-8db5-3f9e70ef33e0
 24 5db9f7c8-896a-3b94-aa36-8b76e8c9237f
 25 eea6f507-ebe4-885e-ac48-497d490b0bc6
 26 0b273fe3-af2b-3fc5-ad86-8d5fc171af19
 27 d2339b7b-cc75-686b-945f-86e4dee8c8e3
 28 e0387329-d5cd-304a-a1fa-f9b3b2a68646
 29 d134fcb4-13b8-1acc-a4f1-a80f50578840
 30 a06b3692-19dc-8a75-85df-8f7bfcbd6ba6
 31 be3552f3-733a-4054-b1c7-78e701ad3f57
 32 7ca639c5-da83-414a-94fa-d09f78e629c1
 33 d02ceb0c-fb15-1eca-a2e8-3dec80f52807
 34 7c97cb60-b1a6-47b4-acbc-d26d8645f1bb
 35 802a2334-b706-872c-8072-f95175210942
 36 beb23711-2fc7-6ba0-80a0-b4f451970a6d
 37 93f7b653-673c-4991-afd3-04e822b98949

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8875401821303680180735038363184414864. Exactly this sequence comes out of new Random(900).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 171 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results