A858DE45F56D9BC9 archive

201210050723 10zkng

explained decrypted filler

seed 209

Metadata

Post ID
10zkng
Title
201210050723 → 2012-10-05 07:23 on A858's clock
Posted (UTC)
2012-10-05 11:23:08
Timezone
UTC−4 · title 07:23 against posted 11:23 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210050723) = 5a65e8268eba51f5f0a9c11156bc3f41 (name+title)
GUIDs
38
Filler GUID seed
new Random(209).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
226 · predicted N = 38 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CEE7F1204EFB9B1D 53F6185F8BBB18F6 EAF4610AC02B4767 E49586C6DE4FD155 D494185EB30271A7 56E0FAE9DD4328C5 ED5692EE6DAFC318 57979F2351D66628 D91490D82E496AD6 F30C17859A9E7954 A4233187611B9B66 F532F91485338A0D 9D087A3F20687671 7615CF96A2F9CFB5 8A8323DE4D39548E 202E4FCD0CCF0AF5 843A2F334836ED23 58F7ED85F74EE223 5F9584BD212676F5 C8F02BDA8DC97DB7 377736C721CEA46D 0A60F0253CB7FF89 4FC25EC5D7DFAC22 8EA17C3C9533C082 F5B302DB6B33C03B 0779833E89093876 67E4502DC4B11CE1 D676EAD967CEAC7E 2883BECA8ADB52E6 F8489723CB497FCE 2D14FE359FCDF0D1 DD97B4FCC031204F 50421EB2086F4A59 B937B30EF30B2FD6 4FFD5A4085C68D8E BA03A423359A5C2B B5F4196D0BEAAB8B 414A729719AB6FF3 98131CEFCB116F2C BA3E860932680BBB 250FDDE6E03C10F2 5FA33A51EA9494A4 4C783032E3A9A809 9BC019FDD9391651 001D6427A4084AAF AA676C143BED8EAE A42634FB20BE60CB B130F9575F1C74D8 98B793AFC1BD8F09 12CB54D813DB7CE7 DC0B600E6D2A452B B5E9510622AA8A44 A10E186E9AD0E1C6 95CF80EE3FE14841 E7713F2A4E956A65 82D023D755285BC2 E2B7332EF86F14FF DCC5C10CD79F4967 802B32E9A651AD7B 1CA53BFFCF45FF8A 7C5E3997E287A372 019357B34CFB9E51 F48DAF952A75B3C3 D7D452CE824DD9F9 1528FD9EC43F2007 99112E1FC8A74E1C 0EA3BBF7B1C4F516 6C40C7C775C1CADB 3A08D7756B545B07 63EEBFA5EEB38E12 E9C890B50A70520F 3A42ABDD5B90291A DE766D2A0B691314 E91EADDB0F8C7950 C853CA6A0D3AD7C8 B89D7905FAB9717F B21165EE4D7F10F1 E1D0AA9394BF1B89 10C1EF40F9B52CEC 1B25EB2969F29915 39F54ECD53C899F2 B5DAF4F20A7FF90D F834CF124647CF70 99DCC07E1D5A4AE7 802C16522388709E 2B2B04507C510BE0 DFE54F92202696DF 17EC48DDC41BBCE1 CB8789DB56A5B58C F601118F18798874 C1E2CA53FA2A5314 E52939E800292585 02D3EC692437B9DD EE7A7324FB40B2C5 5C1420194BCFFA51 EE73A14A80B2E419 29CFD99AA33D1AA4 6D73F28E8308B284 F3CC9B93FB5AD073 7632358D1D3496C0 8323F371C233AD8F 3A7029AAF9A19B24 502BCB7C154398C9 14FB4D97844FAD90 1BFA16C6DF1696FC C97019BD11B43747 758ED7E173903284 2D35CA19DB89109A 2751EF9AA9E4C904 066784FD9CDEF8BD 215306B90B303A25 493A4B19F9100EBF D0D56CCFF8D9B8CA 93DB8C1EFB0AF001 359B3B117D47B067 0148E32D628E37B7 D2C74391B881F745 8979B16E9DB3D552 999EE3148A57B515 3E6F2C14EDA31347 E33B7983E476C4D6 488EF0AC4090E2C9 1F8F85BC5810222B 30F240A24279BAEC E5ECECF6AD388432 A5020155F7E70157 825AC40B7C1E6907 C87F6A86505767CC DBA8F4ABBF09941D E3ADCF1AB542232E BB160339AD5F80BA C79CE29D92E27CFC 4BB67C36D304C282 67DA1E314BF30B50 F470B1105CBE6FDE EBAAB5A241A86370 F1E28BAF64512BA6 325F3B83C02EE594 8B2B997872CCFD2D 5A6DEF0B2A9C334F 3107E37E5D224B30 97BC91E845C2315F F5CA23B6FAE0057D 43177F8FA32B0C3D B9A7038D9600E770 9913D489581DF3CF CFD0901615AAD66A 3C837E7213BA65E6 C5067E23C5C6AC37 C294CEAD519CCC15 12EFC8DE923DF76E 58A413568D3A3A5A 397017B0DB7C540E
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210050723 (name+title). Key = MD5(password) = 5a65e8268eba51f5f0a9c11156bc3f41, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8c5a7d6b-99a2-8858-b89f-227b765e07e0
  2 84aabb1f-1585-1dec-bf15-0265a81166a2
  3 4e28c240-e301-791d-97db-af27fadc5b25
  4 f7fbd42f-5ee7-1e35-8ddb-1d12d2ad032f
  5 3cb41b6e-8eb6-521f-98a0-ad5d93faa3fd
  6 6e231a84-41c4-15dd-9d21-c53c527502b5
  7 284f9c32-773c-4966-bdc6-f5555c331c66
  8 046d0478-c65a-2a72-814e-573d7412f917
  9 efb1b42f-fdfe-7590-8d64-78b178b01eb9
 10 5f040f99-89cb-3688-a856-c2dc3156fc5c
 11 3a54f037-ea20-205c-86c2-c694c36287f5
 12 028460f9-4072-5b47-9b46-b8130832b3b7
 13 b4bdf7ed-0796-284d-8eb6-618ddfa82972
 14 3999082f-de1d-17a7-b898-1da8bb7ecbd7
 15 61e06fbc-2210-214f-a6f4-e67ac4123a39
 16 7a384f1f-3041-47d1-b860-754606108efa
 17 7478276b-d303-6e13-981f-91883e797845
 18 013bb4a5-0aec-54c2-b462-6cf7e88636ef
 19 d19fcdea-c6a3-3c96-9307-257bfd5258e6
 20 bd262217-2bbe-25ac-b281-d8d1a2b9c02f
 21 2f689bef-ee61-5f09-8d16-3562c60d6bb4
 22 15bcbbd0-fd88-156b-98a7-e27e9808b9fe
 23 5806d951-9df2-2f79-a1c7-eb56eed59cb9
 24 cf1644de-c4eb-00cb-a36b-8ed6f8886aba
 25 d54b81e5-9202-1ca8-9864-946366ea8df0
 26 d6255250-aee1-8438-b793-7d3e363c73fe
 27 01da6375-a953-547a-93b7-8960c6a61386
 28 2704bcfd-ed87-169b-8ae6-66ba294ef70a
 29 6d590804-eb10-2b02-a5b9-1f4230148e7a
 30 7bbf17d4-3597-39e6-b20a-974c0777bed6
 31 64cd7495-60d4-3ec2-ac91-62802fd47659
 32 59cf8792-3e4f-431f-ac1d-889183a5affa
 33 0ae659bc-4722-3862-adfd-98a9d1ff7590
 34 541b91ad-0a8d-24a6-89e5-1ada713cdaec
 35 7b5cd466-cc4c-5ca2-8fce-a3742e1ec020
 36 6878f781-5653-7c30-89cd-a881a34dfbb1
 37 3149e136-99eb-1af8-8fdb-105099f8b052
 38 3b182fd6-8f89-705d-bcb2-1159e46a3f21

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 81715142732521246532512018512334325717. Exactly this sequence comes out of new Random(209).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 226 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs