A858DE45F56D9BC9 archive

201210051743 110ih3

explained decrypted filler

seed 828

Metadata

Post ID
110ih3
Title
201210051743 → 2012-10-05 17:43 on A858's clock
Posted (UTC)
2012-10-05 21:43:30
Timezone
UTC−4 · title 17:43 against posted 21:43 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210051743) = 56fd69edb662ef046142e79d537350c2 (name+title)
GUIDs
16
Filler GUID seed
new Random(828).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
257 · predicted N = 16 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

79FB4B9B2D593C14 829D961E903E7924 5EE6970CCE824174 8A831C60575E2953 55A30616EF04E597 DC107B6B54490249 B3E29CB957CE840F B9ACDB9AF9B64279 C16499CFDB39AD8B 5615D76F82C6D97B 7502B7D6C878717F DABF877AA87EDF8F CD397E70B24FDA73 1D9D6F7A6C3F1066 11F6DA003CD8A341 0057DC6984515FC7 C88D0629C0F2A1EE 7D4F7F9ED4429D54 D82512049E49094F 8EA22CEDAC496537 67D79273B07F2593 A6BC9C8175CC86BF 1436E07B2AD1C163 4FC5C664441BD2AD 55EF17771CFC9C56 D86647DE3A0BF32F 93ECD4D77B7C61F6 E7F4749D273FE92C 211E18F94F7242F9 89B65B95918CECA7 BF0EC22D1EE9B12B 5C1E3610EFE5503A 96B75A3C581E025C F1695F5941DE4E44 4867E974AF29125A 048D7F74FBFEE301 CB15C639B0096B1F D60BC542E903FF0D 2F49063F0CA35F33 995CC830E1513467 D3AEBF2F483AA153 FD31E801A7159DD4 CD578E5B0A32DE48 3CA89A98409570EF 065031192D9D1DE2 FCF620BEF7D40AE3 CFB7025748A912C6 81C1C2DF28544A99 C4F365482F508668 9015DA2A74356627 5F717FB46D0C6B4D 6FBAB5BCACF8EE1A 9915812BA1E1E9C3 1FB2939D9F8D31D7 7012E0F52459BA49 293EA539FA84DFCF 2EDEBC0D2D83800E 4F22E0AA8DB84C17 79E231616BA15652 5CDFC496ED3B6E78 CB575139AADEDBD3 92BEE2C77BE0AB6D 5A1CD86442C591C6 083B2DD38C7D1A8E 9635943D8AE9FAB2
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210051743 (name+title). Key = MD5(password) = 56fd69edb662ef046142e79d537350c2, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a0842eb2-b968-2099-a030-6668fd97ea3a
  2 2f590275-a0ec-6c8d-916d-605f549b883e
  3 efa1d427-7d25-4daa-9d68-718c674297ee
  4 5fddb3c9-d8a9-2fb0-8dd8-9f1941a4228b
  5 eb713deb-7aae-0814-9d2b-160728039046
  6 c5739885-f077-1354-8188-e7af56368c56
  7 fae80e42-f4a4-8898-a34c-17a8b599285e
  8 9ed45ae2-452b-7e62-b452-6c6264350803
  9 821f448c-f5b8-3195-9a7b-5e27112000d9
 10 66f4cdbf-9ad6-56e7-80ff-dbadb7e5eb67
 11 f237ebb2-d024-2c8c-bcf8-98ed5c2d9145
 12 f9b9ccc6-bc56-8e6d-a5d0-3cdba66d3830
 13 4fb4de74-f95b-73e9-ab5a-1d059a2879c2
 14 27eb5165-ae33-2473-adcc-04af627db774
 15 407a785f-a86e-5e2b-98f2-acbdebf90085
 16 01248b5c-a9f7-1d48-b205-38acc610b1d6

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2642018735287251. Exactly this sequence comes out of new Random(828).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 257 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs