A858DE45F56D9BC9 archive

201211081445 12uh5b

explained decrypted filler

seed 354

Metadata

Post ID
12uh5b
Title
201211081445 → 2012-11-08 14:45 on A858's clock
Posted (UTC)
2012-11-08 06:45:06
Timezone
UTC+8 · title 14:45 against posted 06:45 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,808 hex characters · 904 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201211081445) = 836716cbfc94b3a214b3bd30753391a1 (name+title)
GUIDs
28
Filler GUID seed
new Random(354).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
86 · predicted N = 28 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6845408A87E1EFF6 EEEED2B11B624E05 F1754CC7927F4318 8DB97F678C786764 B3F4255FBAD558BF 86FD0D08E741F27E 990D6B6BF7680254 1AA7E3EFE7EA609E 7677A25090DC22FE 6A7363053AD6301B E106EAD205CBCCFF C368AAA89CB56F1F BA366A9BD77791B6 6C6DDAEC57C89F3F 30C49A9DD53816A3 6D65F119CCE4EC54 E29625B7B8C6A1BA D85DC8F2251962BC 36F84AA498B41123 BE60032BBF332263 7BB7D47C024F195E 20F5C9ED5E594AE2 20DBD73E2F3A9F90 FAEE1415BF4A98DE 50D785837F06AD78 555231BCFB347EC7 9DA99F8F3F31D3A4 DDB24669B8C279C9 3DADC231CA305488 33E180B6C7017F63 59941696C6FF55C1 5C990075FD05ECD9 84AB8C9C1B3DE315 2D7F2224889187D4 8EA3986DB5ED1338 7DF8A13CD366480C E28CAADB9293BEDB 4A4D0C87DB837374 24AE97A3F5A26DD2 93EC731863E6E6D6 875FEDB09F21EFFC 4261020ADB29748F 98B682F854D9A64C 2CD31C4A8F623EA2 40F01BD862329928 2BA52FE0C59EACC1 0E15EE275FF1CFB4 09C27D0E04FABCC4 D0573B0BE923F5A8 5E4BBA6014D89FD2 2FAA1B1E8884B661 59F53076321F06F7 8FDED800794385B6 A39427CDB2366CB6 D8A271F43A1A7AF6 5619AB23AB465B9B A0A1310D8A414A24 4CF0A96D5F1708C4 32D0C69109BEE0F6 DF5A5A7B32E196BD 54A782580FA70ACD 41EF36AF173DFD28 BC9868B534EF212B 8B9343D383C060FC 34C776C56B09125A 826D2B9A148520DB 11FF2EB4D26EC659 EB679344A2A949B3 7D0AD4850956B966 8765A964E367B4DC 1D69D6FA534C5A02 599960BF1F14BDA5 79930408DFA71A63 15AB6C1F1B91B2C7 3870DF5D71402228 4DB00F68B642EE83 6AFEA61FEE50FE7C 6D1644B18BBEA7DD 82650D25432AB973 D15142F7AB046489 2929FAA4B049EA73 3513E80EDEBEE4B1 9303CE4E8C9A6955 A0C8F20D71EF7956 F5B88C19B19B8A03 C97A61CA6B8CAD4E 2015F371FCED92A5 2AED2ED515B52CCA CBB7CCAFB52102E0 6D5F2051E27EB08A 3E391B5C25F8D5D4 BE35A20F0343E0B4 9D834C155E9B224F E141AEF5D89107AA 345BC45B8D8F120F 4BD926CA7278E7AF AD456F2D8C33069E CA6A5D12E0479C7B 13E674D189332E73 D801A95917053DA3 CC0B66E9D1EE63FA ED057B0A0BAFA13E 6BC2D68095A06939 6CED3143AE80EFD3 FEF0637699F3AF09 AF4B0ED13C0BEFD9 2457FCFED6EB350A 87A72AA8F4D5009E F3CE7363AC15539A EEB78935D03FF3B5 97B0492BAA574976 F9F827A32FE81183 034EC487F5B98E64
  • Read the ciphertext. Strip whitespace: 1,808 hex characters = 904 bytes = 113 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201211081445 (name+title). Key = MD5(password) = 836716cbfc94b3a214b3bd30753391a1, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 28 GUIDs as hex (shown below).

Decrypted: GUID list

  1 91debd1d-91fb-56c6-8469-363bd25ed6e3
  2 07fb82a8-c328-6506-8058-ee7e56fca0dd
  3 a50328b3-0e8f-11ff-83d6-95834355f824
  4 ef2a1751-60e9-1fe9-a397-0a8fd712801c
  5 5a5f71c4-ae3d-02dc-af45-d5634667b7e9
  6 2ac11a60-06db-82bf-8540-5eb10f533e16
  7 3b2866c8-f431-4e32-8a3f-b4298fb2d4f3
  8 c6cde847-2c10-0d0e-a97a-373645f845b2
  9 2ab3559f-1c9f-6ab0-a9ec-fb0863710bd7
 10 d0896435-1a56-7342-b578-c262a996b8a7
 11 a94a7952-eddf-087a-90e1-48df0e42153b
 12 2f239857-b783-789b-83bd-a4e45aa8772e
 13 347ab1f3-1956-81cb-bcdd-d92841b001cd
 14 82735305-caab-519d-82fd-95ab9983d55b
 15 22d69f36-f54c-6c72-a343-8f6fe36d9c56
 16 f3f3a9ad-2d53-0f2e-ad83-980e0a87ba53
 17 7d5dbb0c-50ce-6036-8126-1bb0b7cd221b
 18 f67d81fc-8e17-4985-b6c9-5f610f240697
 19 db6211f6-3620-2149-bb1b-55cb7e143dca
 20 be3fac6d-5fe3-317b-a169-0acb44e058e6
 21 0a59e587-6322-763f-84f6-a094ed2eb34f
 22 f02eb679-8c22-67b4-80da-c1465ffa5924
 23 cab0833b-2fea-7c7f-8ee7-5a8e457a7689
 24 c1505f83-75a3-6314-9e64-d43352b68107
 25 8302f3bc-077b-3dc9-a56e-59c9f381cea7
 26 0f294003-a44f-171f-b513-5a3335d613a1
 27 83e06e90-438d-20a2-951a-beebe71737b9
 28 9f95c828-301c-0476-ac29-90005c1f0b99

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5611084067078560642376763120. Exactly this sequence comes out of new Random(354).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 86 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 28; the post has N = 28 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs