A858DE45F56D9BC9 archive

201210062204 112jhv

explained decrypted filler

3DES(name+title) ECB, 24 GUIDs, seed 615

Metadata

Post ID
112jhv
Title
201210062204 → 2012-10-06 22:04 on A858's clock
Posted (UTC)
2012-10-07 02:04:41
Timezone
UTC−4 · title 22:04 against posted 02:04 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210062204) = e54c0ce54f252a9d1d4507aaa072d152 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
24
Filler GUID seed
new Random(615).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
342 · predicted N = 24 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
19 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3910717B58B21029 FE08C7508E010B7E B805D085F165831B 7DBF9D919AF75854 5FF51AA3CC1BCC2C 6356491B10F4580B C7F513DB8F7AF925 17DD54C9E23A4C3B 19350DA0E31A118F A974653D6C6D755A 77C41CBD4C2E60D8 14A517D218AD7EAF 91469404F0FCC531 AD19425FE5C7B3D0 B937DA1A89C28372 D45A2374576E3FB6 31038DB62D783016 C97ED24D9C4DAD40 0F81C964B5390361 32D96F87AECD9904 ABBCCC7D619AFBB4 C01E2D69382EE8E5 49C8372550A38ECF 672B7224E09B4000 4FC93C8BF03854DD AFBBACEFBFC8E863 DF7853A4A702F3CB 291172AA9BDF2B87 6BB3204333EAA35C C3EF31EA8FAB2ECB 717798BE72222A27 C003039C2F4CC61F 413E0D70A3474400 20F08C36998A76FB D498BDE90E124020 D73AE9E9F44C4BF7 AF61BFCE353A8A04 CF3D23817168C9B9 2AE580BD9ED40CBF 76ADE96CC7BC7810 756F590CA2CE649B A4D70B4CABE02244 5870BFD600743D10 AC97A696D37F7F63 67EF927C2FC3054A D1F91CB7033E48D0 B9E6F1C4DE807557 D0F64FA64E212120 C2F17E749F2BB1A1 7E220BD4353F3FD0 0D7AFD57311FEE90 75CE1A91D63F04C2 D03F0D02BB786B86 E0049182DEA566B2 2D0BCFABF6CC15D9 3F4ED24DD572B60A 6E05B9F75DFF27DD 382D80EA3A7948FE 84B69A4EE5FC0E85 28489930AC28650C 8CB01E34E15B9209 899F35541D5DF1E9 5EC59DB68161C86B F051488AEA17DAE0 27C58BDC88C44CDE 20197767FF8548D2 62AE0BC14D3227DA 74D5B10A81527927 59D782FA3DBF9A80 B604A5540CCB8DA2 5874C1545309607A 8B6FF9634887073E EE9CC03AFB909332 1B269780AF15E6D9 9C0F937BE47D50E2 C767EC219BAAD89A 119E8CC91BC1A15A E81ADA806520DB0C C57195B0AC2575E3 EE424378AA6A1983 ECFB540ED3FD682F 4D05354E82271A31 DE82550131994655 83A8C5D8A4E68503 5A99E43CED1DECF9 0762822BF5F7D922 130359E37BAC0D7D D4667C51124140D7 8AEE37A42A76288A B55E4CE3F6256A0A 0312E6B681C60B47 3F7ACC24BFB7F721 ABA823477ED302B9 1CD9B3907726EFF4 F98BB55BD65B3A18 8B8EAFB0A80FC817 1310FCFE821835B1
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210062204 (name+title). Key = MD5(password) = e54c0ce54f252a9d1d4507aaa072d152, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ea7bdd2c-0f8b-0855-a35d-4c08fe0e5d46
  2 c279d950-2dfc-2e60-aaa3-a27a3a5272ca
  3 e93221ea-c5da-53aa-a801-480ce34b5444
  4 b6311c56-9ca4-7f88-9562-f47ae86bd1ae
  5 81ded47f-04b8-756d-9637-6d71c06d7094
  6 d260980c-582a-028f-9f06-8d1b7b8dfe5c
  7 83e8894b-473c-441a-8066-449b3d1aa757
  8 8c72dcf0-4155-813b-a182-1395e5623b9f
  9 82ceefee-5119-0a6e-bce5-b8ad5d17deaa
 10 2620f1ce-c060-0966-915e-528def26a444
 11 d92eeb79-47f2-3ccd-9693-0b4267d89dbd
 12 791792a8-c9b9-5ea4-87df-efcba6c4222e
 13 b0901bd2-2292-311a-b622-a1911289f64d
 14 f1f4cc52-48dd-3f50-a7d9-b310fc1cb636
 15 24a0803c-2b81-4172-ad88-0bf5083ffb27
 16 0107ed8d-9149-0d03-8cd8-f482578b391f
 17 c8de76a1-2f62-3fe2-b08e-569f408b7c8a
 18 457c644d-ce9a-2414-8210-aa3674981f7e
 19 dfe23e46-f562-212b-9b79-010be34fef16
 20 0c65ea20-7664-4f30-9881-50d5a20937b8
 21 7dac3783-668e-46a7-9060-ccca86045a49
 22 8a554d3c-e601-63ae-8cd7-8d23a617da98
 23 45f8fde8-aaa1-8af1-834c-44dd531cb3b9
 24 3b218a21-bb6c-76ba-8504-5875b6cd10a7

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 025770480035334032244687. Exactly this sequence comes out of new Random(615).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 342 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results