A858DE45F56D9BC9 archive

201210210600 11tate

explained decrypted filler

seed 901

Metadata

Post ID
11tate
Title
201210210600 → 2012-10-21 06:00 on A858's clock
Posted (UTC)
2012-10-20 21:00:06
Timezone
UTC+9 · title 06:00 against posted 21:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210210600) = d59605f2b52f64be82a2fe74aa8be704 (name+title)
GUIDs
23
Filler GUID seed
new Random(901).Next(9) ✓ verified
Run
Run 37 (seed 425,468,968) (seed)
Draw
15 · predicted N = 23 ✓
Machine boot
2012-10-10 14:48–22:48 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
13 · 7
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

65F0D5901D7D1867 9AB96F468A1332F7 4D711CEB4DF96491 48669F292EB8FB88 C846739562F8A830 68B84848E06C129F 4368649098671DF1 072C689A0546400C F967DC41CCCC2284 AA15183C6C4DFA40 06277575F8DA4A58 5C45E7E41BBA5EEC 5EF1DC2CE76AD9CE 83DB7D7A3B387821 E8D320DA1E275D9E 81CB1BD59EAF2EFB BCECE6290AC5B4FA 94FF3F71F8D43B5B 165E2B535F3DA584 FDE5924CE86814FF 7ADECACD0E25501E 8AC2D57B20AED25D 9F16EBB738C1A33C F5BBB7220AC24FD8 CBF2F244915F0DC4 86C85926FB7AB737 5EEBEB33D1DE3CE9 4BD47E570D29960E 8E6527E2ED11A183 FAC322D71FC93E78 0D54450380560C78 94E86CDD8773265F 2373DFFE20D21B89 179E542488C3E5B6 FABBF672864739D7 777729647F549D6E 0114B5120AF7EF15 4595C59E03F32356 2F5334A110FB9FE7 BCC5159ED2D2D40F 4389045793B6ABFC CF806974B96770B0 66AC36B8ED5411DB 1EE73E240AB41E15 CE74BBB59F0CF115 DD0FA0D69F722C66 857D5F870A05230F EB9E2F0C45B07C87 C3CF782281C18303 0F6A9771E3921C7C EC6B1184C213EFC8 E376AEEB608B39D9 E04A1DA55C85098C 32653409AAE617D8 07FDB805309B9F2D BA6934B1971895FB 1DD831C7A762C62D ECE3F4E12D11A9C6 881EDE8BF25B8644 D3725BF6C63C5922 3B8756D6F5AB45F2 05298483C111490E A7BC31694E149DEA 870A0A6D6126B526 73277075484D2E42 5C9F185C54219E69 A18B8981C5E12972 7D899B6F917D5CC3 4600125BAB0FF319 D3475BFBA827D38C 05B85937D7C6377D 0D6AB2A4AA8F913D EC0CA0BEA9FF6A4E 99B9B54D5DEF0662 EDAD6A7D699615A5 E5D17975A4631D14 B93E730362313403 0877F7D936725FFF 49CAED664BBDFF23 B5180133BF7ED403 E0C87A5311CCB47E 565D0A68B1A55731 2E8643B734614D4A 0EA550EF8302A736 064760481EC79CE1 1CAF71B1C2664096 982DE7E37CBF4789 4B3832D01E152357 1061A55FF8B50904 41F96B819FD2F337 AFCEA917882E193F 9E9DF83B15FB13D6 D927DDDC251AD7C3
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210210600 (name+title). Key = MD5(password) = d59605f2b52f64be82a2fe74aa8be704, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1c9f4805-30a2-3984-810e-8fb65a383389
  2 18827bf1-0839-1903-92ee-7eeda0daa481
  3 821aa459-f75d-5f53-9f82-5e96de7213bf
  4 553e3860-5a3f-754b-97b4-ab0c363fa335
  5 24d670ea-4d41-8f77-b755-5cf47edf2308
  6 a8298a00-c8d6-8e1a-8a39-40dbc483c159
  7 a9c5e852-1650-5cf9-90c3-c3f2a80e7f6f
  8 ea4ae09c-bfef-4d3b-84fd-e89bb406f547
  9 f4065807-9d1a-4745-b4aa-2bc67055bc73
 10 9488b656-e2a5-4dac-b71f-b5fc780fcdbb
 11 8ec4cc8a-bce0-039f-ad61-b4649058e9a1
 12 6e54cb07-7b25-88f4-8b6f-f252def5eeff
 13 b6e8bc96-517d-0fe7-a16e-a6dda4483548
 14 f6009654-c125-10cd-91d0-074c5d002dca
 15 d8ed7047-9acd-5a0a-8b86-a62abc74b614
 16 369b8ed7-1910-6a70-b7b4-17570d53c41b
 17 8959bd93-07e6-58f7-a9ad-4a8d0c6fbc9d
 18 ac858990-8047-5331-aa06-c7e79c68e424
 19 12c3d968-f5ca-0c12-93b9-a0d9ae6f652b
 20 52356ff7-c6f5-1b06-bde2-ea86d3cf1edb
 21 65230b2b-e540-473f-b5a8-8ee63779e22c
 22 f331c05e-d5fe-86dd-81db-a5a42ddbad54
 23 06b4a115-a7fd-2f78-9de7-36c77f4798fc

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 31578854440801565501482. Exactly this sequence comes out of new Random(901).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 15 of Run 37 (seed 425,468,968): new Random(425468968), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-10 14:48–22:48).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs