A858DE45F56D9BC9 archive

201210081446 115fhc

explained decrypted filler

seed 923

Metadata

Post ID
115fhc
Title
201210081446 → 2012-10-08 14:46 on A858's clock
Posted (UTC)
2012-10-08 18:46:16
Timezone
UTC−4 · title 14:46 against posted 18:46 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210081446) = 412cddc9fbbd3f5bddbdab4f03981437 (name+title)
GUIDs
16
Filler GUID seed
new Random(923).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
464 · predicted N = 16 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

74704F4371A2BCCF 2CDAC3EF03426295 44954A218E341FC9 697E52E42E0579A0 AED028AFC1FBA17A 3AFED2E913EEE8EF C037C7E0FA6E9FF8 4290977A25E18EAF A2E8F7E4F715E51D 0EF5F74C94C46A7E 4C11C0A8EFC2CBFA 22F58D04CB99BB32 DD9D34C1853BC90B 9F24E61FAA9C40AE 9F3FE58D0FB0FA11 9CD462E7E2F693C6 17A7CBD3EA6C8E2F C78C10455133D977 F9B7FB5269FEC2E3 A2BC6C52C72606F4 71DFB33364C85B11 5986386870427C90 A49919E12D32DCAE FE1B1A9214CE538B BA9F9565D7F115C5 5320B448ECFCAD03 8D1386EE8F02D914 E4F8FF1C893F9F34 B83A0FA458CCEF8F 7F25449BD64D7813 2C8E24E5C31C5B7E FE227ED82343AEC5 3CCB8E4D5545EDD8 3E8A9119377DAE9D CAA911730468A4A6 7A7C4A7A47D7E184 27B5EC988FC1BF00 0403FBD20D3B4822 6D47B82D2875C5CC FB0EC55D5EA9416A 821C85AEAFFFA8E2 E27D2A250879AC42 4109FE53FCD35850 6643EA5DBE3420DC 029A2E90B9D8DDF8 D84358BB39566240 985E3E6632819065 3F84D3E7BB47E7C0 948926887FFAC9CF 6DB407EA703C8842 90E34285B0FA4910 607B2C48C3283A16 113877735ECEB428 C56D38DF175676B8 9D735FE7D7850AAA 2D15B912B0403512 F68EC8AFCDE31AE7 89E2F7C68D84AEC0 0D632E056E3ADEC4 A42C17EC0F5D3316 9342991892C6AE18 09DCE86D6BC33816 DAF60CCC9E1DB3FA 88CBAC610FD4BFE5 C47F7BA4841BEA70
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210081446 (name+title). Key = MD5(password) = 412cddc9fbbd3f5bddbdab4f03981437, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fe50f407-2518-8a69-ad65-25b14d9b394d
  2 0021b4fc-b636-5dde-a41b-b147ef265e83
  3 c4e7dd65-1f08-878c-818f-57524a0d01cc
  4 34ca7fbb-420c-547f-9d70-a7540d47780c
  5 6fbefb19-eccf-817c-bd7d-f005080c2fdd
  6 0e723472-a9a3-15f3-9251-1dddad913705
  7 b72568c5-5e38-4946-a3af-5923f5221547
  8 e1ce2088-ca68-42d2-8486-ce64d3274e53
  9 e26abca9-6c14-1e95-82a0-86c98dad9990
 10 6b4553b0-9af7-56b7-98f3-835e3ea2d1aa
 11 9886f004-9b33-29a2-9f1a-a2d1452404b7
 12 ee630bdc-e52a-0c30-8d25-4239b94c9400
 13 95bc715a-ae38-13d9-8731-2e896e941c06
 14 313ada7c-2acc-582e-b109-220f2cdd4b85
 15 0e42aa19-3dad-0dd1-9917-bc5de3334c00
 16 02426728-811b-429c-b107-52404663a4d7

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8585814415201504. Exactly this sequence comes out of new Random(923).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 464 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs