A858DE45F56D9BC9 archive

201210100800 117xcr

explained decrypted filler

seed 356

Metadata

Post ID
117xcr
Title
201210100800 → 2012-10-10 08:00 on A858's clock
Posted (UTC)
2012-10-09 23:00:16
Timezone
UTC+9 · title 08:00 against posted 23:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,744 hex characters · 872 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210100800) = f5adcf704c2e1219f81b88ec92e04f83 (name+title)
GUIDs
27
Filler GUID seed
new Random(356).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
513 · predicted N = 27 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A5C45529F1AD6E9F 33C9251664752D2D E70836E7A60302C5 83B9D2A36EEBFFE8 6D105EB0E809B0CD F89373AB70D0D1BA 5926210A43396482 2BB4035EFFA9DEBB D6787753A64A565C 29B24417166F9211 31CDBAD7688F6122 E7C04116550B4094 B1AA4CD4557A8DDD 3A62B9E0D8BFFCE3 28D500610403B989 1C40A6FB885A62F8 5A030D745E516550 47F4BB5FF615C82C 34251C910A458723 1A29528E63EF8521 FF0AB2D774BB5DE0 4CF629579F00C450 E993199259CEE2B3 474860ABCB82B64C C8663D34C8DCFB75 192BAAA629C955F0 A9A8B22FAFAEA40A 6A88D1D6F7770590 E0027B64CD96C01D C0ACBB895FC09DA9 EC18B019A231B922 DEF16BF5D3ABC496 7BA6E1AC8463916F EC8CC7997B472D22 6A9115BA81EE55DB 9C7C97D957D6A308 0649653BE32F2210 83F8376B0500BAA6 CC6324C19D283D04 3A35E36203EBEAE5 9A1FB538754BFC19 B197DAD84CE43FAD 77F267C0493642A8 DD62E6E4BDFC69F3 B2A949D367DF9B66 4271BA587DE9573D B9B791584156B85E 17E5DD8999CE0F24 20BC0EAD732C0099 24651C3B0060A0EF 35462477964B744A 742B5345717ED885 AC22C09A1B998CEC 47E681E899662700 8CDC75E61ED49919 B87C24F6600CA1E3 72B79986666284D2 D9A3B0B9420534CE B6EE7B1F1C047892 D611AD095188CDC6 E427FACF745C85C8 66165CFF95FA2C59 0C27918E63C83E78 561F5A4D66DA55A2 24EA995F9A696E0D C1064CDFBDFCC417 03D64F9E7EE89B51 50C9DB3C043EE9E8 4646A64657443EFC C0C38EE9951F5A6C 7C8FA52F4B55360C 5CFDDA3FFC6F451B 8F8D997C3A8B5901 291EB8DE47CAC605 BDC98FF805570839 C06AAD31355FA552 EE5AAEE16CC592B6 36A9225E7226E6CE 310CCC5CB51CC9A4 2BA0D23038AB3759 97D9B825F2B7E2DE FC7D47BE73B5F501 99A4FF1CD26627E9 8DBBC07ACB09ABC8 15772ED2A5CE4CD8 B8EFB1E0BB6776B9 8636532347A96863 40D6D293B65A8353 C12BA91844994FB3 C37A85E93003B97F C74060C44B760407 1A79C199D94AB4CB 6ADA87C6BFF095A9 32624BEF88514274 84CC6E428D754A4C 9C9D434E78CABBDE 2998C4C300595134 5248F6F8658E6463 E297BD21E0105E1B D8C81FD6333EA834 37006ECEA80F7FC1 15745AF5D00EA78E 3FF288DB092DAFC7 A6C30B440230D42E 439D518F0C2E3B9C 91EFDB158B763758 7CD05E99F0A72261 25FA3BBC99F7D686 7F097565754C772F
  • Read the ciphertext. Strip whitespace: 1,744 hex characters = 872 bytes = 109 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210100800 (name+title). Key = MD5(password) = f5adcf704c2e1219f81b88ec92e04f83, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 27 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4ebcd290-7605-67e2-9e81-b72a095f4073
  2 e2faa62e-4e23-2528-8286-53daf011f77c
  3 54bc94f1-94c3-5c52-a0ff-844c67ac247c
  4 e9c2abd8-1ccc-4dea-a955-713efb6d18cc
  5 9daef82d-d3d2-8a77-949a-96c538afbf83
  6 268f09d7-ffcf-5336-af57-0d1b0745d9a7
  7 24c584d4-b10d-3e23-86be-f7009d5e99d1
  8 6cced26f-34a9-0630-bd93-ef4fe39ef747
  9 ecf55812-dcd0-0991-b775-015d0fa9e976
 10 292eadbe-d832-4176-aa7d-5c4d9b3406f1
 11 021a5940-c2e3-5169-af1a-37aee04827a1
 12 e2cbe036-c796-3e54-b248-616fb7eb60c8
 13 be4ef085-1de5-3add-936b-c1121425e673
 14 1e5444ab-4660-6e64-9202-5d1ad90b1202
 15 d824a560-fe0e-1490-982d-0eb771812b50
 16 e886f878-c1bf-339c-8d17-f4fc8a6fcf06
 17 a76cebe1-c04d-4d9f-9109-2c8eedcd84ec
 18 b11b3d17-d44c-6aeb-84c0-c5c70a7af847
 19 2184d1ac-17b9-2d48-8db5-1eb298867b04
 20 958675e0-2acc-1fe5-a9e3-36a590296feb
 21 cfda0454-77f7-1086-86dd-cb6409bdb67d
 22 d9a87992-86f1-16cd-9270-338fefb1e487
 23 a95bafb3-242b-141f-b9e3-cda65220c9d9
 24 0b2ef755-47b5-35c6-a426-0b749e7204b0
 25 9fb49ea1-3dae-545b-8796-f3fd18227a66
 26 a5076523-efa5-4d2e-855e-77090e7ccc62
 27 d9ce97b1-faf1-0348-921a-745ef31a747c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 625485300453361346211113540. Exactly this sequence comes out of new Random(356).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 513 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 27; the post has N = 27 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs