A858DE45F56D9BC9 archive

201210051943 110p2x

explained decrypted filler

seed 876

Metadata

Post ID
110p2x
Title
201210051943 → 2012-10-05 19:43 on A858's clock
Posted (UTC)
2012-10-05 23:43:37
Timezone
UTC−4 · title 19:43 against posted 23:43 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210051943) = 4f604d90772b1550ffeae3608206563d (name+title)
GUIDs
24
Filler GUID seed
new Random(876).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
263 · predicted N = 24 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

352E2C487AAF752F 5891A64EA1C45F86 9283EC4C5593D6CF 82D8976E679583E1 83423C58B0F26DB0 AC7D8DB4DA386141 E54D62F8AD6EBBD0 913F3CE348BBC7F3 85F3B2FEA1DBC3B1 553ED84DC0DCBB36 FE7519CDD1B01C53 9D40D9223E0579F2 29AB759CF0B3A4BD 2B67B80E33AC8E59 982D882B722DB653 44C4E534EC63E5D5 88D5F2D360E6F31C 46BCFA78050F0A2E 5B84DDBF86601BC4 6B1BD6EF4630E78B 430185C107CB1043 5AA764BD4904B15C B321F8B30367812E A2281CA1E27731D7 3B98C465BC7C39E7 27BE51DF1254E2C9 6E512D5DA343227C 8B6BF1B8CA063552 E431B21A58154AB2 D6E34D2B00DAC6FF 868F51180CE7D4F7 FF07BC5B7F34F40B CD28B9FC871C9ECC 1F18F49FF80A2CDC 644BA38790CB0BC7 E8F6988C4943616A 0C582EC38C028C2D 2B6ECB50BF8761E3 279267CE8FB58E38 C049CADC241C0322 2D7463418494C2A4 4E587A6B04832523 F72415CD5161B988 CF03E8CB59DEDE8E 391D88A4641EA4AA 3F45D5E513FAE946 54BEB8AA3CE5FD8F E247FCF3C5FA66A4 AFD8D791CF825F76 3D69377D0D3098D9 609FDC58889C4E78 E84A62F2D73FFF11 89DB57182FFA3F99 A9B3EF3A8E0ED0B3 83819298D37C8867 A8BA1DBEAD12A20C 76E9CE384507B449 3D62F6EB2C9F49CC 341E81F0631CA8BB B2F071EC347F26B2 AABE79CC3C0AED83 780AF594D16491BC EBC788303BDE3258 293B41A208DC59EC C6EAD4E1D468E503 F0D4A0F68D4FAEA5 E72B99FB00E867AE A70AF95A77E4D2EE E5D20D77CF24815A 3C266006EA3CA26D 4A8272FE1F7BF484 877F4ECF15E2C65D 67409FAE62168724 E62BCF081A77B88D 62842783F281A21B 7FB43072C085EE37 D652DA3C50230E61 38FF1868414B1AD4 46607C5E56BCC4BD A4EB6CF6C0F31FDC 4B2009BA24A4DDB1 FA78ED04A64FFC48 C85978AD7371B269 A71D691A9C9A637A EDF7BAAA72BC406B 4944A601D2636003 4BC0FAC722D40579 FC5C248FDC75DAF5 7938DB6198F004F3 7FE8F755ECDEE9DA CAAEC3DBC1789E8B A8D319397A013261 B4406DC5AF327ACD 2E8CADC8976B7E49 46CC550D6E5B7749 F09B0A96934C1685 0F926AE87D4485CC
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210051943 (name+title). Key = MD5(password) = 4f604d90772b1550ffeae3608206563d, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 68724919-c62f-331b-8059-237f743c6fdd
  2 4fc82ca7-f2e4-7ba7-a6bd-46bd35d26073
  3 90ccbf90-cb6e-0700-a9a4-93b6ae1c289e
  4 a364becb-0d2b-4e58-9b84-085efc7a29c0
  5 fb132041-953d-6c44-9c9e-ad0b3b9d3157
  6 0a888bb5-9bc1-0e73-af35-c3b484520234
  7 81d51b2c-a8df-3ade-91a7-77bee172f0a8
  8 419c1833-32c5-823c-a8f8-35c305fd49aa
  9 fb9e1790-c226-3ab4-a5d0-b68174356fcb
 10 5a3cbdde-c1d6-23e8-9f32-9076663680aa
 11 89db2d69-a5b0-6b00-aa25-d0ad2b5ad294
 12 23b58284-68bf-3713-86a9-1b79afd0364b
 13 2a4c3c73-c53a-779e-8a73-a796e091ed01
 14 90e1b61c-d28c-1ea1-8adb-58ca57943514
 15 fc73f146-b5ae-1cdf-96bc-dcaddd3b567c
 16 fecba2f9-64ae-0703-998c-187ef7c52d61
 17 1e82af73-9ff5-0eee-9e5c-4b6fd6f85cd2
 18 af08a99c-61f5-1558-b940-aa03df917cc9
 19 f1bee46a-d88f-3c52-9643-9044b2502f59
 20 9fd46612-f2cd-4aa0-9f98-44df00b187c1
 21 c6de4be2-f293-1b18-9849-71860cfe773a
 22 7b60bd4d-da30-66e0-813b-2c1f54eb9610
 23 a73a422a-e701-03d6-a7f8-0e6722ca966d
 24 78cf64c4-016a-0767-97e2-df5b13b1af53

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 370460383263711001341600. Exactly this sequence comes out of new Random(876).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 263 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs