A858DE45F56D9BC9 archive

201211081405 12uff3

explained decrypted filler

seed 854

Metadata

Post ID
12uff3
Title
201211081405 → 2012-11-08 14:05 on A858's clock
Posted (UTC)
2012-11-08 06:05:04
Timezone
UTC+8 · title 14:05 against posted 06:05 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201211081405) = 545f76425eb49f44138c2ea5bd1c0e2c (name+title)
GUIDs
36
Filler GUID seed
new Random(854).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
82 · predicted N = 36 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CD4F5DC111A1B641 7B3DA4213CEA0C26 6186B34F7AA32489 03FE20830E85DAEE EA6AD2AAAB293ACC BB04334936E09596 2A28C4FC2F902D3C 4CC20929A236741E 102B8EC2EAEB3F9D 78FEFE0E5E78FCFC B1E2EC0B6F9600B7 5412A1EEEFBFA67B 41DDCDF74A9C36DF 692399E353121F6E 985A71848C55CEFE 97961DE1BBF0F46B 9537A10EDBDDF573 B6698F901DFC40F1 CD68A79EE0C10ECB 1FF4EBA136A56078 23897F47FB95C669 7032A1A944DF5967 6435961F4C46C7C9 284B71C137CD4066 4FA482ED98BAB5AD 5DD0543C0DF2C1F3 23492FCA3DA6E5A6 E7107EF3FBB48B73 F15F7678EB7D6004 53C7AB288C415CBC 8EEF68F7E7ED4C56 D2EB738A2F5F20C9 36418163250ECDA9 21E521B8698A244D E6B3976860AB65DF 8534E39FD5881D32 74467DE280FFFB19 5F59DF5642B64B80 F6CCD6934B343836 766E84B3B3BF3EE1 5EE27D853FFC1AB7 349119A8E17AFC83 D8B551EF32212E2E 90C9D050540157D6 0F5FE22A05613535 8B543B477F4CB4E6 5EDE446E3A14BF0C 1D69547A794D4D6E 95AD12B35D7E86DD DB0C5AFD42480845 CFA4DD989AA55983 5D0A4AF29A6AA20F 07003F80738927CA F2879574DFBB8263 B3C7B16C3680B1EC C0257CB909518BC3 4ED890EBB6C4AE95 D20D298E4E88792B 11DA567D9533F377 78FA65D90CE1FCCF 6CBF0E9CAA21937F 2850DDA910CF7E2E AC238B846EF85DB3 BC2F57095DEA0115 53336BA9D00C3838 1C3478194164900E CB7C4E1FF1AF4881 23D71B94CC7100BA 41D7DFA929C83CE5 1AFABE40C5FF7246 C1B8A0E35850DCB6 A6077AE053F5A6C4 8B89ACC53E56AAA3 530341CD7A761D2C 58B99D761A3C8BF9 1314FC9E873AFC15 6714DAF7933969A4 10EEBC2C978F65E4 F5317554331E9329 23C16082D87EB457 D540C24BC21C6971 34F418F51553004E F1CF79130CD5DA12 EAA14A24CCDBD5F8 0C285C3AA99B5FF2 4218D03A8E8293C7 3F046EAD97A22AAC 9A6B902C754DA1ED 26EE4BBF5122C12F BE6D16373146A82B 123B41BAA2D97A28 7177943ED685510B B79ED7FDD296CE45 CE361AD4E421E965 E20759369A2ADAC4 8A7DC6FA31720C96 E01DF468830E4CE8 708535F13D5E7AB8 D4C37368186D72BA 761E4374140A3D3E A79EFDECA87F7E3F A5035E8E4844782D 468E8093A7584326 C0F5E3A1887349E8 F598F8922F0E8807 699722F82733F5E6 96A37609E76A02E5 F1A2ED2D259CD453 C67B8F2C90C14BC3 EF96F971845F9C55 E7E87A8E90521FE9 C481F4F559492612 51DC8AB143387BA9 1B993DF18DF17169 E18D45C99E53DA66 C117C3F00AE56B21 7F6E39251B6874FE C0724684BD336F9D 37E3A5C97A52987D B8AC234CEABD35D6 0B008AAF13147114 36BB36E28C2E52D9 76DE64F8F7DAC485 A84A72488196532B D9B3E234F3C8C67B C91A2592B3925517 3A3DD4174238A5A0 293AE49E928CB946 E20F52A264F61DF6 3696C3FEC4FDBFF9 4ABA5DA145261985 87B5BDC1B35320D0 C9619790AB9C1B88 2EB86A5D05091F10 A5AD043D3F382A8D E2B819CECC2C37C5 77CB21E4A8EA3CFA AC546D7C11D2ACA4 8AA3AFDBD18F54CE AE2FCF939418D871 72B138ED6047EA47 FC30A4A779562380 ABF0FB3A93CF623B 10D20E1481EA1BE5 1D298FCE61193AEB
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201211081405 (name+title). Key = MD5(password) = 545f76425eb49f44138c2ea5bd1c0e2c, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 57b0ed18-24c4-71ee-b824-1a92b4a2886e
  2 983bc480-d840-303d-a845-79258d46d884
  3 5964c005-96bb-6ca6-8479-23e2b3018e96
  4 89dca79f-103d-7eca-af51-c4861e6fbcba
  5 1d6aae04-3da7-6b33-8730-ad52f99c25fe
  6 640cbe93-975a-79a0-b278-da2e80724c71
  7 77720a5a-783a-4d2a-ae61-15e9339038ba
  8 20961afc-0fc0-765b-b3a2-20b71f6f45e6
  9 aae8a47d-a129-5986-a416-1b9f69aeb19b
 10 5ca0533b-9da2-1e6a-8258-810bdbe028d7
 11 8789c9b6-a601-4165-b332-435c22ff757d
 12 f1d47e18-3a99-17cc-b58d-100542f1540d
 13 f8d7d646-a8c9-61f3-90fe-065aca2475bb
 14 4db7d32b-6ffb-612d-bdda-4905e3528098
 15 2e04cc19-909d-645c-9dd9-f08eab36a795
 16 22bca200-0293-3744-a4e7-c4aa709b076c
 17 6be6ba1b-c5f8-700b-bf9b-fd6a60a6fcae
 18 380d1b3f-06e3-48c0-b013-a7be8b3445f6
 19 2a9fd5ff-076f-7bf5-b0e4-0462bb773d2c
 20 420255f3-a237-8767-a3fa-3f5fdd1b8b6c
 21 59cbd456-9345-2ab5-8e83-bfbe85e16891
 22 53874373-22e5-30d7-8b2c-99c39493bed3
 23 c6f7a390-bab4-2a08-99d9-8c8f537a08f1
 24 aed5ea5f-7db4-343f-a5b9-52bb29566216
 25 d2cc0e07-aa80-3c80-87fe-b8448d824275
 26 7effbaeb-8b0d-7ef6-b6ef-1e4fe0d83697
 27 5949b499-1e12-1d82-8fc9-d0b380d90773
 28 c1ca44fa-fea3-75e5-bc0b-420aa0e5e8f8
 29 ee176e03-cd5e-3174-a1e0-5eea4fd10c7d
 30 68f1eb4c-65c6-74ac-9612-04f07d648aa8
 31 3343f99e-881d-439f-9495-c180386f868f
 32 5e6edef2-fa5d-3a29-a4e3-88c808bbc96d
 33 6bcc205e-cec7-6aea-9a25-395f959bec3b
 34 62291ede-8e30-30cc-b6d7-054f3cafd16c
 35 e6b149f1-2280-7f62-ae77-09ba0443a4a5
 36 096a5f10-bb01-659d-8fb7-e4bc277428e1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 736767475141666374782323371737436376. Exactly this sequence comes out of new Random(854).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 82 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs