A858DE45F56D9BC9 archive

201210142100 11hkuw

explained decrypted filler

seed 641

Metadata

Post ID
11hkuw
Title
201210142100 → 2012-10-14 21:00 on A858's clock
Posted (UTC)
2012-10-15 01:00:22
Timezone
UTC−4 · title 21:00 against posted 01:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,256 hex characters · 1,128 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210142100) = 2539dab320bc6c86a85c0e77a323477b (name+title)
GUIDs
35
Filler GUID seed
new Random(641).Next(9) ✓ verified
Run
Run 36 (seed 335,015) (seed)
Draw
25 · predicted N = 35 ✓
Machine boot
2012-10-10 20:54–00:54 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
17 · 11
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

636B000CEAEDB91A C2FC7F8D19AD4EE2 E9B6856DC7750558 1BF09348D25789B0 535FBB336F2192C6 749CBCC15371F150 5440D0AEB7ECD83B E13C4F3E990C06C7 B0D8D525DFD88AB9 94AB0345EFC0C5F6 915740F9F6985577 035BBE12F36886FC 21A900110F2B99AC 32BD5E5F08D86954 C278D5BDD17CF638 8C735AACBD6DDD2F C963457D0D26BA4C 155EFA54D7AC1AA6 09A2684BAC73B944 5760F334200EF7C2 48546CFA38A4C63C 0BEFBBDC240913B9 8C4C3E4CB41050D2 191F148AF49633FB C6FA3A7443D8DCD6 B4A673C69DF96E6D 74BB75AC83DBE77C 8DC3EF6E712147AF BD26A944DB3D9879 99B42D9E95CFBC08 A9545048B53F7AE4 88AC51487F20F24F 6C52408399C7F25B DB57ADA4C64FA791 F66982C70DFB12B1 16A34467BFF40A75 407CC58F2A0E72DB 25D8EB10B60189DD 5B0EBAAD748C975D E4F7C80239EC0A38 CBBBE600E29C4DCC C307A9A98527A340 E4AAF137BC111C84 9D55856F1620DC70 9983C11D7AA9DE74 EBBBD61223D9537F 8A881AA79D516244 838C2D18472258A8 1E655A4571CA107B 2A5BB443348C1E56 5BDB809B30B3FED3 6C87239DEDCA380E 6B0DD4D832F3560B 6D14F78EC3658D08 F05E81EE59F133B8 40A5DB72BF04DBA9 71D7015BCA103530 0CB5FAB8068CFC42 3BBC8E080956017E 4AB40EA091C5FC9D 29C385D7D1792D5C 33F1F159F33BF4C6 8337738D6474DD33 78839B8C62E60C19 8BC2DC7A614F29B8 5F294BEC1D9E50F1 79B89A0BA3C4AB61 D5023CA44A60869F 9E85439252588C3E 081BBD8D22A0E78F D2AF2336EC1C0BBE 3FAAB451AFDAB463 CB7F44A29AC91C52 DA19D30B1F8E75C2 6284A97BBDBE7975 F3867ABBC7DC4404 60D837DA09E2F22A 0F62CD42F0705EC6 548AB9A8EAD8D2C5 23DF476D94BEDF2B F9691D437A6E783C 936C78325DD4E7F2 6745BFA49A3006E4 EF07AA5EAE51DA73 44B0D98DCC76F429 44B1B6BD259D14A6 DCEBF1E661C50D3C 686B8C3CEC269875 209F25680C2C1001 A40367FE8B845B66 DB4FA17872722B6F 32523A9B3A7C142C 20962560E7690950 BBEEBFE689DCC544 4D622F83B27CCE65 BBE197D3109B3EC1 ACBDFA8BBDF0B0AA 4A3D7511B7B4C58B A6ECAA3BCEE8C2FB 0A2C6EF0DA6839E7 E43F38BD24939FBA AEBE7A6159E6114B 5A40A4569F498E49 46FF3BF60043FDCF 80E69C2EF79B869A F07C997E3B7BD761 8DD5D2202EE54EFD D9865BFE39BD716E 91C4F1E2F5416745 2D8FFE8F5501D996 42E91C784803DE81 F5B3D022F413303D CB35A28E72404AD5 7FD4430D55E4C3A8 808BCAC0BD59ECBB 7BF74B36EF616552 A471DB79F4EB4C6D CF09CAD2B24FF89D E6BD84D3092213A4 6273AEAF13058C22 4B648288B6B7A83E 47A55C65FC90446C F739E4A09202EE50 EEC535FE044062F2 AC78125465B62DC9 F3FCF461047C1ECB CD80732764470C6E 23CF9BB050D9FFAE 62ABAFF3A9902E6A 50E60AEAD73CACF7 6DF0A3A7B21B861D FF49B033F5A4816A 88E33B0CFD8DEAA5 37F24B9201105C2F 1B0DFA99A68FB9AE EB20E83CF26479EB 58859E44DE01C0C9 1E7D6F24B0C4E8D5 8FEDDA674EA29EC7 FA7CB5F042954CBF AD4D02C95774E9DE
  • Read the ciphertext. Strip whitespace: 2,256 hex characters = 1,128 bytes = 141 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210142100 (name+title). Key = MD5(password) = 2539dab320bc6c86a85c0e77a323477b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 35 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6e51c1bf-8e5a-5e0d-b72c-518f0ceac584
  2 95423ecd-574b-819d-b2bf-e2adae237b72
  3 e817bddb-086c-774f-a10a-7a7029469ba5
  4 6f22e8e3-f0cc-3ee8-a97e-1a71870e0c9c
  5 2da5c6de-c649-595f-a75f-809cdb69b84e
  6 0d7d7a0a-f213-6266-b823-d21ec50be9c3
  7 474179bb-2c19-0568-965a-a101db6a703f
  8 81e5e1fc-eb99-042d-8757-ef38a45f303c
  9 8ddce799-1328-25c1-9518-4f7b087a637c
 10 f9196d22-6b81-5460-8472-307545da143f
 11 80d6ce04-b954-432e-97b6-1caaa58a9fe1
 12 72bb7d14-da7b-8805-9eef-756e0033e4c5
 13 29ab925b-4db6-2047-96c3-63d813ba5c16
 14 4fc0c109-6289-82b0-ba5c-29141a9c37ff
 15 75b4fd17-9f3e-588f-9c58-8efdcaec03c3
 16 004dd4a4-939a-30df-b756-e62a1010cf33
 17 dbad668d-2761-2349-a223-d324a367331d
 18 887191e7-ea2b-33a4-b61a-611589f171cb
 19 2abfc804-5955-0f25-ac49-eb7cd4389096
 20 e053bded-3d63-453c-9000-3609031a5f8d
 21 681601a2-149c-882b-87e4-a968218f1ee2
 22 6fd3eb29-b892-0465-b628-3b2f99d6a42c
 23 fe9dad6f-58e3-2038-94e5-e3a025ddc7bd
 24 206bba9c-9271-8901-9fc7-73379b9ee452
 25 ac3218f0-69f0-48f7-a294-16b561ecc628
 26 5a66a147-68d9-7c2d-9f95-d5822f020360
 27 efd3c15d-42fc-01fd-a75a-2ce2851456fb
 28 71cb2dae-eb6a-75be-bf41-f361c30738c2
 29 d4518944-b207-5ca5-acd2-7221462a9f73
 30 837dace4-eb71-2cf6-8205-b0197d6dc03f
 31 87ce1695-eddb-7b4b-a8d0-f767a59c2321
 32 c1a9108d-1b5d-2fb7-963f-68b033e9247f
 33 c50de6e9-0b3f-028d-970d-8e2af2642414
 34 aed2f036-0d6d-07cd-a1ce-e24c51618455
 35 d55ceaf0-3b0e-469d-b50f-af72e24923d6

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 58735600254828532304802847075272004. Exactly this sequence comes out of new Random(641).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 25 of Run 36 (seed 335,015): new Random(335015), Next(8,64) per post. The RNG predicts N = 35; the post has N = 35 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 20:54–00:54).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs