A858DE45F56D9BC9 archive

201210092200 116z2k

explained decrypted filler

3DES(name+title) ECB, 24 GUIDs, seed 806

Metadata

Post ID
116z2k
Title
201210092200 → 2012-10-09 22:00 on A858's clock
Posted (UTC)
2012-10-09 13:00:07
Timezone
UTC+9 · title 22:00 against posted 13:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210092200) = 610f902afa0d65e0dd39b2ab37656248 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
24
Filler GUID seed
new Random(806).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
503 · predicted N = 24 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F1F365CC0C62FFBE 57F9D3BA7968D8D5 1B1CB0AC253E9E97 6AD8B00471D00068 3C0A1F4DF79C2FFA 5F3DDB64F060BF6B D21D95991F793FD0 D84165D02F38E55F BB6FE0C2C8315DCE E9E532F64494C481 E52D340D03A04538 77AD5FEB1517819C 681A7B919D20C42E B80B38C5CFB7C9EC 1C9A5628F1D4091E 8D0D799B62DE27FD BE5304562661607A 60CC881C44624D21 7BA4F3850CE22E56 D03E144554A42D2F BAFA52025A00D4AF A66EA624C3833242 CC09BF90BCEA6239 73A7B0CD95D7EE4B 7156B9FF6D00833D ED062AF5433E43A5 E5D1840CA068945D CAF6CB66B3FDB99F 680DECA4A2B77896 901D8825E97130AB 5AAB4B6E4EAD0507 4EEDB6D01A5F3B67 8533847A412B6DBA DB65A13F125CF710 9F108FDA68E23500 347F8CEBF04D8E91 8975D61E1F6C589E 9BE9B2A2902A5AE7 B08998E35ACA753E 649235ED5B322C9F 4721B2F3758D0C6A 2F519B0C1E28F30E C311729A590D977B E32D82E050765F01 949DC111D9E9A559 49A412E40D6B4B79 0A7EB0B0E17334E2 F58835CA4D58B04E DDCBCEF5A89F711B 7B852E7B5A34D81D DCA9264CBFD3648C F55EDDFA9A326CEA 3853813EA60C7421 353D269B288777B4 4AE56DF603971EEF D903A194F5BC66A9 19CB0C17E1EF6ABA 93C06FEF60425A06 5ABEA2AB3D9AC644 A73FA63422941C12 30A2E96194CCA401 D1BBE23C031011FD 8254F948FFE2BF74 14B874E49BB3007A 37131A8760BD3D9C 26BF8D49F1499755 AB9DDDA3D09018DE 5D8E646B38F63448 5F9223D71F86DB0B 356A664655D4AED6 44969A154CAE6099 4224BF3EB4BB67F5 EE9593F4F980581E 2E8C315DE58BD858 6F0649AC14036434 C7B117B819EBA32E A444D102D8C75DCC F38B0E6EAAC0CC9E D85DDD36148DE12E EE7C132A5B2E55CB C0EC0E0636E5A392 0EE6526AB9E15618 1EFB487F2B9238D3 697E071CFDEDB8AC 40183CE8D6CAD798 A9DCCE4FF4DC2940 087806B95045C938 03F6EF9ACB6E3FA8 1590C47B57731709 E2176D89C4DCEBB2 9A02AF0822DEDB3B 6069E2DE400B79DE 83FE30C0A929887A DFA747180066139B AC417EE092749BC8 293F23360941EED7 B973F676F65310C2
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210092200 (name+title). Key = MD5(password) = 610f902afa0d65e0dd39b2ab37656248, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3a1c49b8-0971-70db-b0f2-8e130f3d0652
  2 8a765cda-5144-2cb7-bc61-4570784d84ab
  3 e134591e-c395-1c44-9825-512ca264f8a8
  4 9bd67a37-8383-52d1-ae75-3b74d1d6df8c
  5 990f0035-ece2-022e-89b8-94108e4ae58c
  6 2c4f93ca-cf02-83bb-8899-8d303b5ffd73
  7 1728e176-3d2e-0d4e-8e85-decd8ea59807
  8 d68d6be1-2b11-79df-a4f7-563b70365d11
  9 a58f2df6-1066-6cbb-b215-da533c2da202
 10 81dd89a9-10a2-4345-9f6a-c5a7c94a2d12
 11 54fe56ca-f478-05e2-b5e4-47f9d1ccc6b5
 12 28603f08-e627-6ef2-9b24-0062cff79742
 13 43931f50-9003-6c56-a9d1-7b9851e41845
 14 711d805b-2588-7a30-8de4-64809dcb8433
 15 54588b08-4e96-114b-a8e4-ea74e67a6e20
 16 94fb6273-ded0-39cd-a3d1-861c578631fe
 17 9bd4cf29-a471-6db4-bc94-cfb42794efe5
 18 c0ae3727-c64b-6f2f-9435-18004c38387e
 19 836f1df3-71b6-4186-abb2-7b7263323b30
 20 c5475aa7-9bbe-354f-982d-ce7407df9845
 21 b2142aa6-8a46-817e-80a0-1255b6fd9901
 22 b7b38bfb-3f3a-5443-99e0-d0a0f3848f04
 23 1255cdc8-0cb5-1ba9-85c3-36b19eeddddf
 24 eed420f1-93af-5eca-8151-1a736e9ec722

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 721508076406671366438515. Exactly this sequence comes out of new Random(806).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 503 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results