A858DE45F56D9BC9 archive

201210260139 1240cg

explained decrypted filler

3DES(name+title) ECB, 37 GUIDs, seed 785

Metadata

Post ID
1240cg
Title
201210260139 → 2012-10-26 01:39 on A858's clock
Posted (UTC)
2012-10-26 05:39:48
Timezone
UTC−4 · title 01:39 against posted 05:39 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201210260139) = fc43f203c14b8e4ff62bd039923b745b (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(785).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
63 · predicted N = 37 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

EB6081F52F0D8990 F83FCD2C85DEF1C1 46F3C3836898F7C2 2A6A2EF6713694C9 F6C3FFD11732B795 B68FC152EC663B9D D9811AFA0E80AE2A CA011589A9274BB7 9DC22F688A9A774A 0A6A3495200F3B1C FC446BF427FE2A73 A4869A73307A73C4 0D0E39480EF130D3 1B967ABA294B529A FA31074FF6A5D4AF 18D39BA7F47AB66B 6AE5C6D808672839 D7042703A7A3AE04 D4BE8C33BB6DDC7E 568F2928C1FE3755 F9D0AFB631043767 9F829396D3EDC4B3 5AE54E4542BDFFE1 9BE3D469A3169533 A85749AA7B5F29F9 D31ABCD408A2A12B 961B089A8E5C3A1E 1503AD12A8D7A52D 1177A18542C58CB3 DEDBC376D0B03220 75083AE75363A26D F230D56CFD53FDA2 B135D65366CF75AB 28C649A7F2C93001 34EAF9AF2701EA8A 1D65F16A314C56A2 F92AED722D65AE30 79DD24BC95895462 031BCAC60F6C037C 8C41E70D548D743C 645B911B7F6D2301 6B12E9606A24A1E1 D62D4655565471F5 AB00509E804D1E30 434B86250C19D788 6959D1B9C1303B63 3325CDC13FC7091B 6B08075B5D77233D 954824FD1066858B 139F965DDB14BD3E F716DF40A3D3DB1D B6B030AC1B7E1D8C A02F313A8FB90320 4C0349111E2F7E72 BD8A99B7B3905CEB 93BB8E51A0B3FF26 80A5D024AD39EC48 1529F709177A5903 E7EE957F361403FE 61DCA8EEB750BD0A D1977A9A99F5A0FF 74DFA2DC72D48F4A CB082D62E51FF3D9 9A7066715EEED89E 8F126083E0492BE2 E634EC73518167DF D98A25FB179894D4 781AABED0899A193 73B64A672A44129B 5FAF37F912AFFCE2 D996787AEA7036A6 1CC811E0A0EA6A31 C454409360C84B7A 42573E0120773B43 1661B200A719C1B4 8A0114769A02965B 17BB120A014A516D 2879A2C128F940B1 005C6D96BE479EED BEDCA6F2C3997431 460EAB77CBE76F1F 53AB1FA38B05717B E40521C396243AC2 D064730D43C619FB 89312B8A9E7FC69B 9D6AC24C827B89FB C82EF2EA6E18B746 FFF5A948B6BC8FDD BE9D4D566CCA4DCA DD36E4FCD5B1386B 94791A4CFE773234 CCE1D61EBD44612E E9920A2CC84E3183 AFCB99E27941A65D 518EBAAA63625E9D 59974CA94083C5B0 9F04E33F2950B171 47B3138560CDA67D 231F6FBA3FFA142D CA318F0EBE3EC7B5 060A087B19EF5666 A8EE2328D0A047C2 BE4FC930F032BA2C 176DE81995535826 06269077CEDA244E 1B578394936F81E1 B67219F6F108A8A3 E3C50A71FA10C6ED 8CFAF8A9DAD5D539 6B18B3EDDF0CE305 590A0C7D2CDFF0DD 04A85DF4082969A7 EDCD544DA7C7118E 7265A0F6FFCA04A5 AC60086C98FFD5BB 632F5315952B3EE3 AD114B334C9E7374 C1858ACEC46EB28C 869226257F0F7D4E 49159F4126A2F6B4 1CD5ADC78F5891CD E4780E59879D5EBE F829578AE83AEB03 1EAEE96B738A9BCB 88D6CECCF67D7BD4 C45731E4CD5A6132 E6847F3C886F63FB 56A5E371EEA773B2 207D30F231FECAF3 E7D818CA4484DE24 6F757F2622319DEA 335EB6F73056E231 53AF2797FC14FCDE D2F368B08F8DA08D 417C90200D2956AF 108C90A97FB0E85D 413A0B40B1DF6258 44040326DD88674B B39C6D84668A4A70 123D9D78C9CCBC41 B90358653CFDB619 F76E504B9829327A 7CB3B675F03B425A 30750BBE6639D54B 1BC129D51A7F7E77 9FA8489BFC31B72D C2CF6B00C1C92B95 182446129CF10A3A 1D55E518CB642624
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201210260139 (name+title). Key = MD5(password) = fc43f203c14b8e4ff62bd039923b745b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 75d156fb-b635-7785-9e1c-9e25292d11c2
  2 68a062b3-21b6-1b73-acde-1efa220ed4e5
  3 d823182e-1a41-4151-a3a2-e354f8cddcac
  4 5526be53-fde0-0255-b209-c490909bcbcd
  5 c0481cc8-3700-5d43-b299-abbd6f87f8ad
  6 d1eba861-0552-5e48-924d-dc718b5849a3
  7 a865a9d6-51be-5f94-8792-9c10f26ebc57
  8 f1a62f1b-d439-2c61-8947-1a1d639a0095
  9 7f0e7d21-0fea-0415-973b-449365895dce
 10 c817436a-e907-6229-a903-2c4ddecf4036
 11 834c9681-7f99-5fbc-8dc1-b0eae73d2369
 12 1a09d267-c1fc-28cc-ad4c-88a0a170526d
 13 b0ba05b6-e4ec-2418-924b-71167a39f159
 14 1e858d7f-b140-7bf0-8333-87d5d3391a7b
 15 5b81160b-68b5-4fd3-a018-772fa3ca3c9a
 16 9c73d9c2-581c-2109-a311-72193fa014e1
 17 ce5906a5-6276-7c68-bd8a-2e67ea236901
 18 36fe2843-d686-627d-a870-614098b31791
 19 f5c36ea5-6308-8230-8ab8-0648559dfc7a
 20 26927bbf-cc55-2652-b3fb-4c6e39356ba7
 21 c1b39bb2-fb74-18ec-a50a-848cc358c910
 22 261c2e06-3084-3f0b-bc49-df5832917aac
 23 d616f80f-cbb7-5baa-9955-f67103ce9bf7
 24 4e7a3078-fa9e-21e9-923d-a8b467c189d9
 25 cab79237-46eb-5514-82aa-41303dd79893
 26 502c6b86-1367-3b5a-9049-d5d6a6d1d2a9
 27 d1507431-14e9-77c5-8ba9-475afc869408
 28 3b40b69f-d332-065c-8b1e-e160364e128a
 29 66834ef2-d4c5-3584-9227-8749ead1c83e
 30 4d1708d8-9722-2ef9-b6bf-f09feb9d2f3a
 31 f7b5b07f-af94-8ba4-98b2-39bc1b5e5d3c
 32 f1895966-cb42-2f9f-a3c7-506830f0a058
 33 dc9f9516-c34d-8992-a746-4c87d06127d4
 34 8920dc4e-60eb-6886-a688-b735fe454f02
 35 ea7b1591-a69b-6049-a13e-90685c519fb3
 36 92c28566-0d01-748c-9411-94d9a75a0de3
 37 07571d6a-3c79-2ada-8cbb-3337cbf7f932

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7140555206522742768213525370328286672. Exactly this sequence comes out of new Random(785).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 63 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results