A858DE45F56D9BC9 archive

201210101300 118h9f

explained decrypted filler

seed 234

Metadata

Post ID
118h9f
Title
201210101300 → 2012-10-10 13:00 on A858's clock
Posted (UTC)
2012-10-10 04:00:23
Timezone
UTC+9 · title 13:00 against posted 04:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210101300) = 3cf980d564821af1cf9714dd1cbac8dc (name+title)
GUIDs
37
Filler GUID seed
new Random(234).Next(9) ✓ verified
Run
Run 35 (seed 854,622,578) (seed)
Draw
518 · predicted N = 37 ✓
Machine boot
2012-09-22 10:16–10:36 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5901A2D477968E63 F125B9AAE7BA81BE 72F14E811F5E53CD 417F758328E939EE A065FA5AD9778BAB 2E1CC15BF87F5501 B38470C0231EF4E9 9E3CD72991215F5C B8A7F655E0BA6455 1B8889AD2477FF8D F6A106BBDA0F0C43 836518814E37AFE6 D031A296DC24953A A1576C4675FA9CA7 7DC19F2F4F74DFAD 12FCB442368CFD62 387367A273D2C4F4 8A9A1CBBDEA8395F 1B7A023D490F26E8 5158E0C9269D2C76 CC028ABE1AB01140 3649EE1FF42A013C 32405DE5EA68770B 600AE0D5DC52D4F8 26E68D0CFABB25E0 BCB58E95A1694A18 1A598EB5CF43FDAB 965B24F48FB1F066 256A297A0EA17FB0 582582BD844B8263 235BA5078C2C92BD 8B7EEEB074190EF4 A7E572C09499226B 06366AEFA28EFADD 5582DFB6ED9CF0D5 65E35D67E4B32CBA BA6741C9384372BC 7AECC58DEADB6E0E 4A57C3D247FEEF20 F6492495751A72F3 D9CB193DA98DC2C9 85FD137A473CC337 ADF103151844BD31 CB487BBCB888BA33 22EDD442F9AE4185 2C9A6215D5AA8D27 9852EA312FB843E5 9820A10D32324188 2A55AAB43300B5AA 0A93B2C914D16EFF F9D65B61E00A3379 52006E589AD6AA28 7C6C753E72E06421 EA3B9D9A7F907395 7B9AC762D2D5809A 46B2BA772FE5DC58 C0EF8D6F572ECD42 E3C6F1AC0514E8AC 094C43FB4C9411CC 66940DD02488B1F5 A7C825DAB14E7FDA 9CF9ED4884908A06 15E56438BDF85D61 DE9DF78B4C745830 4BE0979767105D77 98EF3DF16980F7AB CD1C6C26D2604F53 B6F64B0201114C46 C05DF9C6F8E3B019 CDF0BF88B6FE46DB 83F8839AC544CF97 D550A449524D4A60 1E6F08D207AA0FA1 E0161F69A6D7E7EE 4809BEF614AD82DF 6CB0ADFD281419A8 8590C30E8DF2665F E41059565EF61545 E8B4D90BEC03620D 2B0746CA81C60577 DE62F6008F1E87E8 53877E42D7DBF3F7 891E51B945805D48 E65C50F4E0CA1B3B EF2DEA4224F69049 8BAA706FCAD991A0 4C084169F7A2AFD8 BE80DB51A9CA8911 D4032B5A3FEADEDA DD2BCBE5F77957A1 1A98C50B5FA55E25 858D32F5AF1205BA 6A3CEB91DE31DC92 81EB79F54EF60F5D 93947E5CF79DF246 1284C5D15E7CB428 64D72922347F8FF4 54C5860E296BEB0A 2E85D419B384E916 A3E550B8AF690862 1AF26A3523F17B8A CEE8F541E8417C22 1CA09FEB95B4FF44 FC7B5BA272D23D3D 71CF6DE0F4E56053 A6053CE22D20A6C4 3B62AB29950FCEDD 7C65176F56525D3C 2D159BDCAC3181B6 91F2F1080E95B82C B00EDECBBE6D042A ABBD42C4CB858D3A 1BA55C733818BF40 EA20701095FFB2B5 4D4A1A5F5D7DA7D4 98FC6B555796EC1E C393E74188976260 AAE89EA027FCBDBE 211753BF4B49BB36 F5D7033E791E21FE 3C8D30D916B3D2B8 04640B0487193210 921DF616DE298BE4 225B54B325EB9678 0691809F0C3F27D2 7B5BDFB63FE97067 39DF118A8D25E914 D9680E03E8443AA0 1A76971800EF1701 FF009716E3049939 1AB9A8FEAB81DE3A 314487EE6375EA78 03443914A2AFE95F 009F5726F3EAD500 C7DD44CE3ECA8DD9 90C6BFBF590DCBDC B389A936E3C38706 DA6D2556BD760A71 6AEB76DBD3B454A8 61E62D8A8C1320B9 7756B723CCCD2FED 86646816A3186C7D 7B5FF87D5651A0ED AD5A5D1B72AA85C3 AFB37B5434A171A7 5679E4627DDD6DD7 5D11E351101DA645 BDC541ADDBB18EFC 07967DD66B4209AD
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210101300 (name+title). Key = MD5(password) = 3cf980d564821af1cf9714dd1cbac8dc, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e04bce89-5580-8259-bc5b-bc6e81cfe82c
  2 31ecc73e-924b-4256-bb8e-a31f0c599a8f
  3 95b546f8-14d5-2f69-a8cb-181e3cf520a0
  4 0aec4d03-7443-4620-b383-6702f72acf8e
  5 51035674-ffe6-7afd-bd33-67b2fbe5808c
  6 53f6c9d9-4290-07c1-a3da-8d430eeb9f6c
  7 78735918-3f32-6bf8-845e-86919afcd868
  8 6d9c0f70-9582-74e9-b643-d8c4fb19e469
  9 b4d572de-bca2-8ee8-a8b6-bc8fe9fbdc50
 10 89d43f81-344e-57f4-a960-e68e06bf158a
 11 5530a19b-9513-6cee-ab9c-1d8b53e4dd45
 12 d7ddb5a8-e45d-1928-a52e-d8a293ac27be
 13 e5fc5c91-eedf-490b-993a-e021774f028a
 14 b9c3e1e5-dcda-118d-bfd9-393cc8d54718
 15 5e91b5c7-527e-651a-a73c-8ae6597beafe
 16 7dfb8a1e-e689-142b-9c4d-cdc5b7e53fbe
 17 ed76e6cb-b6ba-2abf-ba4d-d78ed59aed43
 18 5d1de9ff-a30d-0be5-9795-0f21e2c67954
 19 9645b6d0-bec6-02e9-b8a3-22523971416b
 20 d79376ad-19b0-87ef-b2b4-f6e12675db36
 21 b30762e0-7fa8-829c-8ae8-32dda9425880
 22 561cb1a0-69bf-258f-a021-4c312c170c5c
 23 95248b5f-b0b1-4124-b445-9e1bfc5990b1
 24 2013d36e-3d6b-704d-ae81-b88e1590eba7
 25 50d37247-af42-5d6f-8fc3-62c55e774b32
 26 1f791794-e9bc-0025-8f63-9575a3cab09a
 27 2eba1603-749b-1b19-94c2-0f2d91a42652
 28 ea5a9139-3aa1-6525-aa6d-f120471017f1
 29 f4cb284e-16c1-1eee-a39a-95b00f8cc8bc
 30 ff77838d-78e8-482a-9a7a-192f28a357db
 31 e9977875-15b1-5bc5-887b-a2071edffe2e
 32 7eeea124-888a-05ef-b8db-a5107b9235ff
 33 08bc76a0-154e-3d04-a136-911b31e5ab60
 34 95b5dfc6-b124-79a7-9e93-ac6c3efddc74
 35 c4fd0af1-4d10-39f6-9699-4e5117f979e7
 36 bbf5717a-0ae8-84e3-afad-31e7269dd713
 37 8e2156cc-89a4-7a43-a5fa-94a4b40c8a82

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8424706785614161200882475016145037387. Exactly this sequence comes out of new Random(234).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 518 of Run 35 (seed 854,622,578): new Random(854622578), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-22 10:16–10:36).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs