A858DE45F56D9BC9 archive

201209271130 10l1tp

explained decrypted filler

3DES(name+title) ECB, 37 GUIDs, seed 449

Metadata

Post ID
10l1tp
Title
201209271130 → 2012-09-27 11:30 on A858's clock
Posted (UTC)
2012-09-27 21:30:02
Timezone
UTC−10 · title 11:30 against posted 21:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209271130) = 8b38faf11f42c59686a4d411c64ade19 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(449).Next(9) ✓ verified
Run
Run 34 (seed 83,105,000) (seed)
Draw
268 · predicted N = 37 ✓
Machine boot
2012-09-22 10:23–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

40C0E0C6A393CA52 D330650D7F23DF61 E105E26B5EAAD7DF 3834D43EC419FFF7 471E71F5E73DA3DF F603286900BD945B EE4AF1A674BA0DB6 B6254A15FF23E4D6 E5680B920B5B4CAA 4E79B49EFC5A88A4 20EB5E06A390C7C9 7D28D83A1A301769 67E2794FBAAF0FD7 A61E4DCD62DDA423 159676E905BB39BB 9D6761C160586149 E6A2BB46B4ACDEF2 B3FCC866D8CC0C0A D22D5081B272F827 18B2AB72DD5E3203 808975B9CFCE9531 26128E181366B157 484E67B9745BB878 2400C395D2D3DF62 CDD25E0D9784D18C 54CDFCA56902F6BF 131BD9A63B853F96 190E97BBDC77A1B2 23FAC4AF98D5E804 98F569323060FD83 0703C798C71BB362 C2F50BD32F71E2CF 9D77A319D5B0BE9B A0D5BBAC552545EB 718ECB5CDEC2C809 384EB2745CA9683A CCD1C9F5579013F6 063E73190FBCCC1B D310895421F86C83 EC8E623C00F56A8E 1D8A4342A9F8732E D45219D1BF8E05EE 59FE230DE430F9F8 14D988B22F0D28E3 1B18A97D246429B9 2A99CE9BB7A55554 93DE3E5E41698C72 880730AB8BDF3C6F 3924A6D4E3CB6560 69E7DE17BEB96CCA DEEB9AA3D031C377 9E43CD92D4473D69 237D27255A709CDD E58794526C169F84 9D28CEBCD20E747A 46AD7050192F2438 252001D477259BA8 346DB2A70EF13FE8 D8B854DBE82F4A1B 64EDE4AA14176D7F 287642DBDF1BDB00 53ACDBAC784F2D70 F3512D1DCA9CA96D D31DFF2419D47FE8 01211C82220FA381 0A0B361DA5083B7D A6E68B4894D4BBEE A31FCD51D2DD1DE9 43D68F25ECC6B486 E75E5D3494FA288E A113F9F0992CC84F A4722AC8D691A69E C58A1E63834715C5 EF92AADBA7AB084D E1D287132CD427E4 8982B1E763A9C9DB 4CA2BA2478B0EC23 E9F920C3D64DA92C E6F69BED0BD3A09D C019C794A8144900 F97E9333A91A7020 77BA51F010286FEB FCFB537453AF814B 940B6FB7CA3E947B 9073A2FDB2437860 B9178179A6DA52CB FDF88C98D518717B F7B5C5D0BF602516 2D930669019000D6 46F1CE21C6F9DA5B 03F069D7AE6FDD8B 94E186361EFE984F CEC37DC55C863F02 0A8426E4D9066C69 E909BD207D596A17 9CBD59A0F547BAFD 49A9B9990E32C71C BC2EA85E1E40669C C1F26E2B534F9F19 91926F6254FA70A9 EF88CAD4707F25B3 85351485B587CC77 2C1248052C7501F7 E0CB78940B9EAB12 7644782E2629C446 C5BA1D75AAAFFEBF 5334737F85DDD52F 072B0E76F95AE902 0F59D7F8AFB9E4CB 397299B1410B0409 C61107D918AE9570 601C8458C38C349F E1D3808FE36DD74E F7138382468B6B61 7AA75871AFA88984 7B03CBE5D20226C0 E6E176D478C65E0D 4D9503DB6FA24D1B 6D935C94DF7B0CA6 433FF7A07D3DDBD8 C7A1AB2243935D73 6F3FB52452093523 F7E6FD5B91522860 A23A72F3D51A9658 E530F942ECC8AA0B 47B378FE94477C2D 57B6E09669590E5A F6D3C8426C0CBF37 03045468E7E1BB89 517A8321ABE13C0C E2B8F50EB39D3566 A5DC3C695849C47D 4AF9CB005427A821 EE975133C489F4D9 BA43937FC0C1551F 81BD6555F8F7DA53 A7746ED14E896A97 D95A06DA0792EC12 78F7126A6D28410C 8E3E06A613C8C582 AC30765A1E48D007 6AC9990504D740FE 39A115E9A7D3EB60 013ECFBAC6E42F50 6869BE48406E2F6D DD9EBD2FA361C9F9 9F42C3895518543A A333497C8E49090F E0093B6F633D8BED
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209271130 (name+title). Key = MD5(password) = 8b38faf11f42c59686a4d411c64ade19, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b2a1ad58-8499-2826-9f8f-7c8879e38e3e
  2 12eda3d1-6d55-5cdd-ba7f-dbe8030528c6
  3 b32fdeb6-d5df-5368-a27e-05faa2142b53
  4 26a9d841-7c0e-342a-9858-7baf06b897df
  5 1a6cc068-34db-8c37-9dc3-c95a2d72442e
  6 26b1b490-48bd-8033-9ec0-1cd19e680fb8
  7 fbc91fe9-d7f4-04df-a473-a560e448f099
  8 d4003297-809f-60ae-99d3-efd05c095d81
  9 dc197815-9379-4b4f-8740-bff6d2edce6e
 10 eb5866a1-1557-7a78-8c70-27dc1d01e7b0
 11 ae4e05a9-5cdd-0eeb-9cc8-7711212ef874
 12 44b288c7-821a-0483-a665-461a0d9ff16f
 13 c05b74be-f74e-27b0-8173-8ae51f78fc75
 14 74f501aa-b9af-06d0-b629-94dfa900a04b
 15 3fb3f4bb-0de2-2944-9f1c-c5861cf8eabc
 16 d4b6472f-ed5e-3e3a-99fa-f7d7cdae8932
 17 add407ef-6c98-540c-8bf0-9a5c422d1415
 18 dec9381a-c986-3d3a-8fda-3dc3ea23b756
 19 45ed2075-b9df-7e55-b1f0-ab16754ec220
 20 e4faefb7-55a9-100b-a6c0-bb740156807e
 21 7904a2eb-bfc6-41a3-92c6-3395922fbb2b
 22 2530325b-b903-0423-ab75-c653ada3dd6c
 23 4abd50c6-5e92-7030-a600-acf0280a96c2
 24 fcaece5b-769e-8c58-aec9-a014728d03d5
 25 94ac005f-624c-6a33-aaa5-6d0b3c66c5f1
 26 df7c3121-57f3-20d9-ad92-1cf9c35a5f8a
 27 adbe0f40-295a-8a3e-a075-ab77d6a3aa25
 28 71b70586-4614-82e5-96ff-cb8e8ff3d0a6
 29 4828f386-c3d4-5fe5-a52a-8eb2b9efc7f7
 30 9697f443-17e4-6197-a18f-9baa815e2503
 31 d9af8ab1-c45d-8910-bc8b-5b85e5da5e29
 32 f823594a-148b-6ece-b612-ee250b4937b4
 33 ddaa5ea5-9630-7617-b7dd-8d2ec895cbd4
 34 8f1e615f-af9f-2f6e-9c2f-f0c07d08be16
 35 3cd64ff7-40b1-3b30-9cc8-4f66d2be2152
 36 03fb4b5d-c83f-16d1-bc07-19e23fd8408d
 37 b9dc4728-b151-8c25-90d1-e0e5feff3c12

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2553880647002023537140786288568672318. Exactly this sequence comes out of new Random(449).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 268 of Run 34 (seed 83,105,000): new Random(83105000), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:23–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results