A858DE45F56D9BC9 archive

201211081745 12umnc

explained decrypted filler

seed 631

Metadata

Post ID
12umnc
Title
201211081745 → 2012-11-08 17:45 on A858's clock
Posted (UTC)
2012-11-08 09:45:18
Timezone
UTC+8 · title 17:45 against posted 09:45 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,104 hex characters · 552 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201211081745) = 57fb283ead5353b6819910589075e5c2 (name+title)
GUIDs
17
Filler GUID seed
new Random(631).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
104 · predicted N = 17 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

532B58C072B87667 1ADABF8790F33601 7A540931DE8197A3 F4A65E2340B8FC91 22A65D2AF4FAF836 8D4AD05F0345AC87 A04FBA9B8AACE804 6133F65C8C1DA665 987318E80519AF38 F549FA6523DD3048 34DFEF048F08828B 1B12ABBE3E3FAA49 878A63B37BC9414A 165EB240EFF109C3 FF625CB2332BA7B4 39719E02EAF54C8C BB2752EA06D4C08D 3E0645F9F1070A10 0D99EBBDD0E36D56 8DA1E3C27D9DB4D2 A4780804BCC6BEDC 619652A1FA30AFFA AFAAE93EE78E2865 E18DE47211BEE152 609644DC26612804 BDEA2126E556E12C EE54E66B5139C1E8 70B702D4BF90DA8C DF9AE2C9083C90BA 38025C3351BB55BE 7CAAA4E3B38B64BB D1DC5265D5F9887D DF020B2DB9B32BA0 A25820C1E6B028C5 B92590F7C6F241D0 E109FE4FB6401EF7 2C3C8787ABDE7929 D8E53A81DED6F0B0 6A4E807C2F0725D2 6C0F5523153CA6BF 181C4FC7FA9CF7AB 71A7075C9357359A 9D72ECBAE2531EBA A19E18FB09F53C24 AA0E13DC39F75D26 EF5AE43FEBB2E781 B8F880915E908195 AB3DAF2247B05768 1CE5D1987CC2E09A EC548C5858CA8129 A7C0798E6CAC257E 080971E60198E4D0 0DFECC0D2055FCB6 A93CDBB35FBD5B13 BD9DECE25A6F50EA 10CB6431465D567A C6593B8B168E0A54 7B9F8B0B26B0FBC8 394E3C21086AE14D 341A2A1592C3F2A9 C0B9869F05EF5AE9 E6855A78D9FA29F0 7D6909A93AB31C31 B4E2AAC0B4102E45 F836894CC965CB10 05EAC109D5ACED26 8B33FC883CAD1E19 8E384C79ECF77F37 FC515D380874DDB6
  • Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201211081745 (name+title). Key = MD5(password) = 57fb283ead5353b6819910589075e5c2, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 bab17e02-e2af-3f0e-a824-eed625c285d8
  2 ef332dc9-9f4e-8928-bbb9-b2d3a28d1239
  3 5e90ad3b-c972-75c3-9050-fbfc0338dc66
  4 9d7cd63d-4f4c-2684-a6a5-a51e6b032ab8
  5 69d938b3-9798-0b51-b910-89e78e1315bc
  6 04f25e33-4bcc-8a6a-bc9c-d345aa6f39aa
  7 204bb4b7-34ef-5a98-a71d-93002d6824f0
  8 e7ad934e-61cd-0834-9e16-4b11673e4ce6
  9 fc3a49a0-e086-0884-89e4-9fdf3d186b8e
 10 7aa05743-8399-8cde-a889-4ab1abb16400
 11 d2fdb408-89e4-1f95-a4d7-2457e4970e14
 12 4b7baa0a-1554-0421-b277-ab0770858b82
 13 a75895e5-beb5-3403-bf5d-1764c79a2951
 14 5c325fbd-2163-6d5f-bf3a-49bd1d7bb5ef
 15 ad8fbd04-cf3b-5dce-b9a0-b47b49b003b4
 16 b4a90b56-e150-0eea-9411-77bef944668c
 17 95ead3db-4d50-0e33-b393-1b3874a497c5

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 38720850081036500. Exactly this sequence comes out of new Random(631).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 104 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs