A858DE45F56D9BC9 archive

201210230222 11xmm4

explained decrypted filler

seed 521

Metadata

Post ID
11xmm4
Title
201210230222 → 2012-10-23 02:22 on A858's clock
Posted (UTC)
2012-10-23 06:23:00
Timezone
UTC−4 · title 02:22 against posted 06:23 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210230222) = a2cd3e62abeec126373446872d0b3a9a (name+title)
GUIDs
38
Filler GUID seed
new Random(521).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
0 · predicted N = 38 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
11 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

3CE8A3BE15493CA9 B07A85021BE7455D 53108028456CF6AC 56083BA61F6C74CC E69419B011825F02 B4170C4444F5FA22 317151312F85AC5B 025B1F380E393AEA 13446FD8F8BDFDBC 1A80B0E1E42B0697 BAF3EFDCC18CEFD0 01A3DD28487FC33E B5FB737CA801C701 DAFF93AF32D52580 E80AA1734E355DD2 4BBA74E5085148BB F39628D68621F23E FBC9F57D32C7B3E1 0968959921D9B4AE 68D2789FD4BDA03B 5BCAE2263AB1A432 0B4D368B0F6D374C 68A8C2F8CBE9AA0B C61882CD26ACABC8 25384B5850202A9B 6C1F372EB0097E9A 65A2C66428B4DF76 88C736A4D9E4B13C 4ECDF83A5D27D14A 46582EEC2488CA7A 670E62B4B2C67867 8631652D964444FE 68340ED806C4FD60 BE5A308F87B3698D 542979392BD9B118 B5896E2E6836A6B8 72FAC74AD10111AA 22175CE8C417BD89 64619B11C9AACC34 BDC21E573B3BBDC6 F25970563C06F3B7 91BD2BBEF11EB734 C1DC0E3DFB942D98 2D3BA62A1710BA58 D0719501B56AB030 AC4A0F2009705BD9 38B41FA50E8B1ED8 BE8E4F017C576A01 CE7EF039F901118E 9E7DFF920FEF1952 3B66AF699C8322D5 7D515999FD804928 CFEA012B6B89A9C3 E1B9F1D626CCFE07 38D258BB8FCCC3A0 C136826415E8ED6A CAF47E7817D154D3 208CA789EED03B09 8C9C07B41CC3538B ACB5E7DEBDD701A2 87F831F6D558E6F0 76BAC3A4848EAA84 28172BCE213BAC1F 2FA69A739B4EA3D6 2AFECD834E8E860D BAE864B188749C94 DBC9A10CCF564320 5DFA8DEC05FAFC69 F82F36B1E2A8EDD7 FCE599883F4C6AD8 01FCC572BBCA6DE7 1B069F8A5F75BFF5 EC05414B6BCAE35B 240CB376C7F64659 E5768082AF511B01 E311D45C57E862E7 A5A16DAB22DCED00 EA6B46E1D7619252 1CE7E31776815C18 FE75D296647862CF E7AD71E9F9E23F9D C79E3F685FC45674 5FC8BDA302AC67D7 D8A33465A17CE682 B5D6568A2A8489AE F4957C22A26D2872 5E289FB803CB5DC6 114C264DA98123AA D7BEC3D18262EFC7 A7E06DFB8ABF87F8 603F8CE726B7D459 23977B262D32957D E25ECEAF93BB989A 4BF3ECD622204ED2 D36702902A9712CC B5F349B6E6FD41E0 E8397F04B462C41C 021AD871267260D5 15047CABEB63CB37 8EB3C541D8D61B11 DB8818F188E5A123 D95763B588F8134B 71B2F4E486E89FC6 7A20EC66F4A6EA08 52A012CBF120E026 CF72691E4DE6C6D7 9F46C09A3D6598CA C3F0A180F8701474 6FAE3A8E3F2C6416 9B20340F1AF99C30 725059008A0B10FE 7C0A90FA49354CE7 02CA9D7DC68AA582 3C6014E77431E6B0 823691FFD3FE3237 8D60C28F2BD19A9C 28EB3E56970A6B70 569FE7D7AC85B211 4C89DE17C17B4AC6 B1DAD6F521E1D415 5F23EE9C9CC29C71 D6B0C5A5BAE23D54 84894F44E1EFE5E3 DF6FB0F824640F29 49067A6E4E170A73 ED7F6DBB5ACCD167 96DAC132821A278B 2FDE6FABABF1E78B 0A378A0181738A6E 2F50048755D345D4 2CA373934DE370B6 61F38E3B46511939 7470B594067AD1BD 8C7CC95BE3852B84 0D6BC97AC9BD3D71 0B032C777FD98444 F9983CB198B30FB3 CAF1C832B8BEDBF9 7C9B138C076D1078 E16F829B05DA287F 9F035E5CAEDE831D EC26DE30B974A3C8 83DF6CF78E3324D6 A3BACD3375190B1B 3E779F0B0E6806FF F434FD9C086C79C5 7659164AA8EB6634 C7B3B56DCFD3503D 87ED20277E315C4E 62F65E2EA61B532A F0168D20610B0A4C 7C8D3CBD50E3286F 87BB7D66A5846D09
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210230222 (name+title). Key = MD5(password) = a2cd3e62abeec126373446872d0b3a9a, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c4c5714a-38ec-834b-b983-efcdf0413720
  2 4cb25b71-f9b9-673a-8f1b-8ab5544f1307
  3 efb5fbff-29a3-83e4-91c3-f17288875520
  4 5ed7621c-c6f1-6084-a5f8-b2b57c1fda04
  5 1fd7c218-db50-355a-9d9c-5eadc00065fb
  6 fb368e21-3e01-728e-a970-a5d166d30120
  7 f0d6439d-4ff6-357b-8841-b699c08c918c
  8 2901426f-ef5f-7990-8ea2-526d6a749b51
  9 fb0c0986-ddb7-3079-933b-ecb8447b92e2
 10 fc66e0e7-ddd7-387d-914a-c82bfcee03a1
 11 f039d92b-e03e-11ec-bfe0-07ec5f178010
 12 6e2da86b-54e5-1551-a684-9577f5bf5865
 13 78fc9b7e-7f0a-7c41-9661-a6f71cd46deb
 14 4b266afc-3916-47fa-a887-7de997da8feb
 15 c1315cc5-349a-6845-96f7-32a3cd5bc3b6
 16 474dc6e1-a6f1-33ce-ad72-960b10b3f528
 17 b39ca141-27a4-720e-9b1d-97e8982f564e
 18 a5a72a3b-b550-02a5-b79a-c086b489e8b9
 19 c079c907-4b30-7e88-9ae4-9a715dae48fa
 20 141915bb-8af4-0465-b1e0-4f02a081ff83
 21 848f9aad-04d3-0c21-acb6-149de074efac
 22 2bcf64c4-fb9c-6e8f-8ca1-3f496bbcae78
 23 92b82b6b-0421-05e0-873c-b9c4dfd0a5aa
 24 6a075232-e64e-0c97-b109-c7c792c8b20c
 25 e080dc83-e0f6-657d-89b9-2e4fb13c1097
 26 e6ced659-536e-58bb-bbdd-cb18282693f0
 27 bdb91b41-3621-7f16-9dc3-755c543327b2
 28 4d8d5b04-95f0-405f-92ee-a517dde4b41a
 29 a6c645f9-c11c-470c-8b2f-0cd07f628d6c
 30 d54e943c-ae95-6ab4-ad62-fdddac419f4a
 31 504489b9-0229-4c08-a115-839dc12d3d5f
 32 31669cc6-31fd-6d60-9717-32c907011d49
 33 60cac23e-77a1-76e7-ae66-fcf3c7eca291
 34 843fc0a6-b34f-0851-9e78-538fcb22761f
 35 ac98238f-0a93-5ee1-b022-a8be2ccba0c6
 36 dd7ad8cf-f436-347d-b72a-3e67c1990ba7
 37 8c3cbbaa-70fe-5ffa-a8e0-3416c81aee1d
 38 68bbb6ec-4292-3d2f-827b-8a0169ee673d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 86863737331174637070060065744646705353. Exactly this sequence comes out of new Random(521).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 0 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs