A858DE45F56D9BC9 archive

201210082226 116aqh

explained decrypted filler

3DES(name+title) ECB, 37 GUIDs, seed 840

Metadata

Post ID
116aqh
Title
201210082226 → 2012-10-08 22:26 on A858's clock
Posted (UTC)
2012-10-09 02:26:41
Timezone
UTC−4 · title 22:26 against posted 02:26 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210082226) = ac7a35aab4186bb3e43547956d76086d (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(840).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
487 · predicted N = 37 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 9
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

719460E5972275F9 E46303E000634732 619A871BAB77FF7C 861AA1A7FB3E115F F7E689F24F1813FF 1A31F9FFA68DCC22 5D5688E4FB015C8D 763EB1D4CB61F7F8 D12DCF28056D0BD7 EDF54A48A1ED219A D7E3AEF6C40DAE64 A6A16B7C896F6A5A F5AEF2F9EAE9077F 6DECE493C05563EE 90388884C246D185 E0D85272A01A1C5D A2711455D0F5915D 0EA97B95D2E5D2F8 81C22B9A8D5DCF2D 26395E844661074B D01E360B5DD6C738 90C0DDA34ED4D989 3621A972AA589B3B 0FAAA1D17701359C D8E665648FD037D4 0B5B3B7EFE7EE000 636BF0AE0B3A69DF AB9AA3E91312ABFE A57712030B4CEF4D 623B7F26797A725B 9117C2AC24D64D73 8DC690EBC12BE768 496F447159BEEE56 4CFD44959A7F6682 39F357BADC055986 27562DB25D971A4A 72526A62E08B807E 1DEC70461B5ED2ED 36E2B5FC0A0EB7CA DD4EDC925961F9DB 951DE7DCE1EBF839 C5E6AFF3D6BFE74A 4A33E970E3E12879 462162A8EB74B316 CEF430938B5DC165 68EADB7A81B7EA9E CC30BE992EA4CA79 C8D2416EB5F92EBF 77A84B83E653F689 54946768E296E77E B6A44C649B8EDAA0 16774D8712E9B486 074697FA3F4A9D4A EDD42426D9C123D5 8DE7EE6371CFA6CC 85668442FE2B9EDE 02EC439C0E296D87 12A67AE009E15EFE 88762D390F2841C1 DCC30FEBDF846BDC FBBFB4757C51E9EC 60DCC689C2E10130 D8819E64EDD7B045 8E34A46E5833BE7B 1844D5A31DAE03C7 F0CADDD0B1647562 8A7436F423F69895 540E422A4FAA3EBD C3F2AA2FDD22A086 608EBC7CE62CE9C0 0E3357A8612307AC 220DA9BE76B397B2 20FBF31C6E9DA18D FE4D4350DE353319 097DE941FE577843 9AA4E9898ADDEEF1 CFDB74442DF2AABF A5A21B3A98512C8B 9344813193F37E51 65DC9BD2E369138D F1E57C2BA3D1EC40 C5D6BBD5959D4E0D 472F73C01A9D93E3 C422230E9050FA6C 4B839499E6F614CA F95854ED75C37C80 E893CDBCB3163C77 92970643DB7375E1 C8512C72F96E2B34 6938A711DFAFF8DF D0498E4C773E9393 21A9B2715F161C3D A42EF69261373C14 350CFB9C5EDA8F5C DB1E86957FE814CD 2924DED4BEE6E96D DFCF577904C40DA0 DE939C7C014CFEBF 2DAF1D14B31C1845 62C90C3D81CDF343 013073431E826E3F 028CB3FB06A48937 A2A764E4BE2A5BA0 330BEC40FE0B3988 93C808A0F5269EE5 B467AA8FE4B883B6 C4DECD6DBD8E33CF BA1E732606DD4D5C 701143FD08569EDB 6B36CA47646DAE0B B2E2C8F2E30BB5B5 D6283B5B64E75A07 211D713FE95C1D5B 14313641655FC198 1B6AE0DA7CC0FF6D 0BE661936CC91A10 1CD8FAC12CEA1436 C0EA1712B964E1C6 951CF6C85EB9D46E 61C7378393CD20C0 DD35562A71A30266 14AB775201057A36 8A8766FA0060EEDD 7EF5D31C8FEBB092 DA4221CAA78D1BDE FA1C9BAC211DD23A C33E43A3C0CC68D9 908A902A8A3849A7 258C2255BA04684C 711BF705ECF5B5EC C5D3B0D2C9D958D6 F178C4E48392C842 D08E8191CD1708A2 C8FB169B5BFD912F 170AD97B05A59526 21B82A53D2AAFC52 806B8E32144B1D9D 68C77296202E768F 1AAE19F64F8D47C2 30CB6F6E7C99E799 DDB87D3B9B26D236 7E2DA458DBD82468 C6261CC2FCB2788E 7C2D9B31746A5F13 F6E6D6254F9F7714 80FB9099CAEBB930 AF30367B46CC9CF1 AADE3F31FA7471C2 9CAE7ACD86FA73E9
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210082226 (name+title). Key = MD5(password) = ac7a35aab4186bb3e43547956d76086d, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 eeaced34-7341-5d14-a053-eece8d877fc0
  2 0019e7df-fa66-209c-8624-33c7d8700950
  3 6c58c59e-344b-8ab4-b77b-20b0bbe3f566
  4 97ac8fbe-a744-700b-bc21-ce3bb337e06c
  5 3413f9c0-b540-4fb2-b1ec-f7a473aab5b7
  6 2a870d6e-ba36-5957-a550-c580c1d4af71
  7 ffb13663-15f6-2846-b799-d3fa4ccab34a
  8 97aa3acf-b089-75c4-b0ff-bd1314bd6cab
  9 b40eafaf-61eb-8ebc-ba38-9c2636666122
 10 b2db6ebe-0b16-0c95-9723-9266add21b56
 11 068809d2-23f6-12ae-8ae7-7c9f0093ca10
 12 47f1033d-de23-2d56-8051-06cf1de2e593
 13 34f1fd86-b131-0fa4-a81d-06d9b8f52e33
 14 7b0dd748-5367-4298-afba-774f27df4d18
 15 d74ae7b3-3692-88f6-afbf-ab01fef62261
 16 23c5136d-1bf8-5456-b6e2-b5043c171851
 17 9fe5cde6-7d89-889a-98d5-89f0cf2a8315
 18 a056f216-1b76-76c3-9fd1-85f86914f375
 19 58564787-e073-38f7-92fd-66fa1b50ffca
 20 c3c02332-ab6c-5fd5-a125-a4f06c8f22ab
 21 0fd2c2d6-5e3b-3bac-b6f6-bee810d41c73
 22 313746ce-60fb-876d-9bbd-d3003ec408a6
 23 85be89ae-bd5d-840c-8d2e-fb2035dad806
 24 df0678f9-1df8-4b35-89cc-8b086df73956
 25 c48e9102-0ccd-07aa-8543-f8b81b3a7062
 26 423d179d-732f-7d25-8a79-2593d34ce3cc
 27 f122147d-6491-1d8d-9fd3-d1165e33a1f0
 28 b359ab91-af87-17b5-9eea-c0d81169b797
 29 57c70a33-8999-510e-be62-1e93d45b323f
 30 f63dba98-0cc7-5155-b3cf-99131d4f6ecf
 31 985a546a-09fd-2e54-81a0-0ba13a6c2bbc
 32 30ecccdc-6dcf-6cd9-bbec-fd6bf07edae8
 33 dff17773-7be8-039e-962f-ce858bcd0d88
 34 08e7bc1d-6db6-06bf-a140-24dc6f25339c
 35 d7b302d6-8f3d-8668-8775-3020fe7cffb4
 36 a1ed0522-2468-1670-b2ce-528012bafb37
 37 8ebb2467-d137-78d8-91a2-2e5fe7a4323d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5287452780120485873538840711552600817. Exactly this sequence comes out of new Random(840).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 487 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results