A858DE45F56D9BC9 archive

201210021400 10tsqw

explained decrypted filler

3DES(name+title) ECB, 35 GUIDs, seed 918

Metadata

Post ID
10tsqw
Title
201210021400 → 2012-10-02 14:00 on A858's clock
Posted (UTC)
2012-10-02 18:00:24
Timezone
UTC−4 · title 14:00 against posted 18:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,256 hex characters · 1,128 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210021400) = 23da6e840a50f6e3cd02dfe4883308b9 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
35
Filler GUID seed
new Random(918).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
30 · predicted N = 35 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

C31F75C378205BDA 4F481B8358B95B2A 4B3E947F3B6B0452 6CDE6B7B17505B67 533807BC71F49883 7368F5D64CE594BB 3610C9AE609C3B2A 90571AE2601BFBD3 1D4DFDA3B76C3CC9 8F3AA710B1FA7F3B F890D85BAFC18D20 C86646B445AF18E5 879D684C08C3BFE1 7B83481FE1D500C4 C2633A12A14960E7 02E7E9954D83B461 005CAACF35B1AE2E D2B9D775DCED466B CF21B26D81DAE5D6 7AF2BD0DF58C9657 7EDFE97B4FA2E189 F70185747AE6C262 CD73518C70618D3B 9FBF818EB724FAC5 FEDFDCC4F1FB43FC 47C8E89F6182A46E CC4CFF9CC38A3865 45C4461A19F2FE28 68FAA5EE7DBCBCB6 BF093269CD61CFAC 9F2B9F9A8837586C 32F32247BDEEEA3E D3C2088A3F897B58 4CD9069322C8F942 F1B88EEB4E059B0E 51C21ACC5F37CB4E F6298D93E37C3FDC A12224521579F758 7D23EEA4CD55DECA 0AE7D13337B7E247 BB81F79643607BE5 D7486014D586AB49 BC7D10C86D58471C 9BAD61DAAD8DB77F 1D93B947DF286077 97B8E6E5D0ABCA9B F69763BAA48DF7B1 1D50252D34CB445A 8B782A255B39E4C3 C332ADAF9D40DFA6 838044F078F78BA4 CA1AC7321F7E6E82 BC8C9D37444D58B8 F508821846643CB8 27FCD52EFAA2A08A 301EB7CCADD14C28 DB5FA1594EF9AAA3 1B891F2608A6FDCC 6521229E2D7DE38F F8BE5A82C5335104 D862CFCF5C2437A1 DA45779FBA419C77 26045CA805A907B9 8B85E860FF573A05 3FFD731DABF0C3AE 6441FE067C470B31 DCC93B3EED5C9E34 32AB8BD47F05340D A5FD4A3D3D148325 AC4F6406F3421D59 C41D2763E30A58C4 923B98E2BBBB3221 7E770501331F7B3C D72BAEBB1A526732 419709629C8C3BD2 84286B20A7B737C8 6A0C8188A86741CD C97E30DD9BAAE94C 6DDF1D309D0469BB D24D01E09F1D9FC2 ABD8AA93BD0379FF DC743A37E26913AE 75B158470103FBA8 BBFB4EE94C438F3D 31D2587B59153CF0 18E83A50C4EF9FD7 24AF092EC2E1CD7F 024087F28DBC7F5E AFF6F256513F660D 200C3326BF41189D FA1780ADC55F0125 237962AE1E012614 CF9214E44949B295 B46BB608E593E074 D4B40272607D1773 1548D9B8AF040D01 C2A1DB4B9A54DAEA 4F89F40A5A64FE93 96F7151F5AA2D160 38E33A2148FCEC1E 3D86560203C7B92D 6C492824A582F9A1 59B54792103C1DA0 D615C60C6ED35215 3D24B64AE0B3EBEF 33CE23FD482C47BC CF893C4B7C2B8295 A6DFD784E1B6770B 20422F4FA52F1BC8 BA688A6AA9C6E3F5 57C77DE14212EAC8 B47E7D08A601E6D8 8BF5217268B1B667 291BD519F817B58B DC251E8EE9F81589 57026FF38E83113D 32C04AA02EC9EE9E 59963CD6EF6FC23D CE46503AB58B4610 E7062A6006B6659C 6FA3B04AB099250A 96EC94B27FFF6A9C ADB566FC2D0ADDA9 3479464F6FB98EDE 44DDDE54BF5CA886 7156E5123D98C2BF E564FDB83D6D9AD1 D7BA43F9652C7EDC 737CC3BD994D3943 3E64BE6D9787D039 ADFC95273B0F672F 483AF503CCFACE91 1F06F542EEEC2D08 9B0AE6D3E202BE27 EFF97FF31899D44E E58234527FF3CF26 3F8FDC44E30820BC 3B16315708EACBC6 488712299EF186CB A32D028FFF8D0EFE 79AF00DFE149BC9B
  • Read the ciphertext. Strip whitespace: 2,256 hex characters = 1,128 bytes = 141 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210021400 (name+title). Key = MD5(password) = 23da6e840a50f6e3cd02dfe4883308b9, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 35 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d52e160d-06bc-2655-8995-d9a83777504a
  2 abac0943-1405-130d-ad2a-336b47b0601c
  3 fc63a1cc-47d8-3187-9ede-b09b6eed66dd
  4 5f380067-1d51-4b35-9060-98dc4b734233
  5 d873b436-85b7-60ac-8879-34ac82467612
  6 f142b0d9-34c9-786a-ab3f-a08059c99a96
  7 9d1ea75e-fe61-13fb-aa31-d1a675cd0ece
  8 f6b3ce91-a4bc-80bf-a5b9-d8ebabd1a913
  9 ff5188d9-ea3f-4fd4-b906-0c35f7ea26b7
 10 db1a8787-3c94-7627-98b2-f35b8a2461df
 11 ffeea108-edec-529c-aa69-3afaa2d71cc2
 12 bdd573de-c2d7-1f40-9e4b-95037ee05644
 13 660af1c2-72a6-6b00-b4b8-33a4119eedf5
 14 361ab6cc-bb5e-0457-867e-38d43a626f04
 15 96d7c8c3-4a3e-5ff0-943f-1d427b147b13
 16 d0e6292c-a42c-37c1-8961-15af04c6fd4f
 17 7226b331-aea3-6940-9712-2bd6042ea680
 18 0d58b6af-93b5-174f-bda8-1521f630d9b8
 19 9b4e0fda-bdcf-4837-9f5d-300b7907cf77
 20 6b8d32d0-72a8-6b68-8f1a-0017320487e6
 21 70f7337d-8a64-7a5c-8d8d-9f47fbf601e3
 22 b5dda693-8125-05c1-a788-5973796a56cd
 23 7eb2fb4d-32ee-1cb3-bd6e-87141eb7f4e8
 24 970648e9-24a4-61eb-b51e-4e1ee3b56d10
 25 0e9b5599-9357-62e2-9b7a-68d968e88590
 26 354c368e-184a-8f01-8635-553c756daf1a
 27 64e211b0-b465-17e2-8117-6cb9e14fdb6f
 28 1049550e-3764-429e-90aa-c445b01361c0
 29 b0151094-b20a-0958-aead-9bd6ace95a43
 30 61644b88-f08b-3b85-a251-e71a6e9e1cb9
 31 82c5331f-003b-059f-b88c-ceba611b3906
 32 c2ad93df-f294-256b-9a66-98f2a067cade
 33 cd4f64f2-812d-4158-bf88-7d2ad03374dd
 34 66ad3d4d-e3fc-0fb3-a1aa-1013be7e7242
 35 0eef4a09-c202-11a4-aa2f-5fced895e0a9

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 21346718475160536146701668140302401. Exactly this sequence comes out of new Random(918).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 30 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 35; the post has N = 35 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results