A858DE45F56D9BC9 archive

201211081725 12um3t

explained decrypted filler

seed 450

Metadata

Post ID
12um3t
Title
201211081725 → 2012-11-08 17:25 on A858's clock
Posted (UTC)
2012-11-08 09:25:16
Timezone
UTC+8 · title 17:25 against posted 09:25 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201211081725) = c4cd8bb8629bbbcc443dfff3726d6908 (name+title)
GUIDs
23
Filler GUID seed
new Random(450).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
102 · predicted N = 23 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

BAF247063A23FDE1 A6FB6EE34D70F38C DB71C1F90A8127BA FC29C1A6BC4A373E 6CDB5BD2CD43BA32 6EBED8D36A6C18BF A0F12C3CE058BCA0 96F94365AB436763 5CB4130158F5E4B3 51C0EB8BAC149787 08F19C394D05A845 877EF23E4E789897 94F201DF06282F03 6C1F011D808E1F27 C4BE920B09691F13 E322B89DE74DC876 CE3E2E0F2B57F46C 15E48FF3A6D1B82E 48824BFE0D425876 8145A91990269C98 F2A56766DDD993D2 FDFA4C720B96708D D387834A69C79321 86CD5A7A27365C12 EBDC9397998EB644 58520FA330761A66 C633272B21E649DB 5A2A376E7354BCB9 27650CA46958D88E D0B03100A5E12552 3E7DC35785DCBA7A A8ADF259725F146E 0ECEFA09D3B22FF2 1CB4015B134760D5 4845068B362D748C 1C97DA5CA33C8BCF 8BC241CB17D3C15D FB13E1D4645FF16C 01B840491496E1B6 D5DEF25D8CC4C800 FA71355FA2D7D9B7 9FCC9B0F800E8956 324F67095A0009A5 BF2D1B6D7F1D6A68 423C56C046EF9D7F 6823E2E8E3ACF363 503810AE36DD7F03 7F3394BE21400B55 498B92C9FA056557 4A234B6A35EA5BB1 0C47A2AE140B28FC 205AB6B6F3DE536E 6A27336A24822464 9FF6A8F40295E046 F773B634D14F9B89 6FC98A2ABD665515 84164CC44A5589E7 450166C917691181 DB12EA2847877696 5567BF6F631CFAC3 E401C54B94893746 76C72DB2AD55FCEF F9E033269FC32FCD 7A3D5BDFE28B21D3 2AF065C88BB4F389 DA0C77B7FAE626CF 72DDEFFA26DDE4E2 1FE79CD8EB074631 51B638E182F4EC87 AC639ED1F78D29EA A04D4ACFA8A7193E 73A138B018F699FE 33068622ED4EE441 1EB8638DA8FCBBE5 2C7D69D96B9533FF 88A4E907686CF378 1108DF7A5F03F803 B4DAD89F6E38D177 E21DDB3B21578696 16CFE846A4DAD790 B3E488314427FE58 B2C41510CD4C0890 3FD15A5B8F6ADDE4 E891392BFCF0925F 03A85C09979128C8 106D875BD67B3094 82C20DCDFE762046 981F9C4656341812 32FBC762E6A27291 F62B1B3606080CF4 D1D2238384DF9BE6 AC80B632DE907974 E455724E524ABC7A
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201211081725 (name+title). Key = MD5(password) = c4cd8bb8629bbbcc443dfff3726d6908, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 14b1e22b-570e-7334-b2e9-40fb170d1eaf
  2 65d23a31-67ca-76e9-ac0c-9a3358fe5a42
  3 153f1266-18a2-2047-b892-705c8dc6d68e
  4 4eafc62c-4f5f-5a38-b68e-b2e55ae2af5a
  5 342abc5d-5b5a-3f33-b688-a7b5124be7ba
  6 b08d7ce3-9fad-7124-bbba-a58455933d35
  7 2798fa6b-fc71-4c77-b665-4823b1324dd1
  8 608db015-012a-1894-bba7-409375f4f165
  9 f900e96a-435c-5b76-9725-d6e57fc8ad15
 10 bfe9a6f7-3b6e-1063-84de-7dfdf6321a25
 11 fe414de5-4c91-7e53-9ef3-100ec6815cbf
 12 fdf20bac-4b23-791e-a2b5-4d94965fe48c
 13 21dc557a-162c-8ec7-966e-e0562cac1e2f
 14 aaeb7e18-b29b-593c-af21-950ff7040cf8
 15 221a7ff2-8add-8ee7-ae52-448afdec510f
 16 2d081aaa-3697-0984-ac71-3df3da4e60ba
 17 a75313f3-6628-0f5e-8f85-cbb05d38d722
 18 86be4186-10f7-8b3d-9728-1014e8d4d9f1
 19 515477e9-2b47-70bf-8ddb-e671289d42b8
 20 2108ff93-3450-569a-9881-c98cbd6c9401
 21 43e9ada9-dd9c-50b9-b76b-07c087f5d413
 22 143df483-28e5-2aad-9fae-3be5c3a38624
 23 312d6644-779f-0f62-829d-2cb05f5cea81

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 77253741517785800875520. Exactly this sequence comes out of new Random(450).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 102 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs