A858DE45F56D9BC9 archive

201211081915 12uovl

explained decrypted filler

seed 747

Metadata

Post ID
12uovl
Title
201211081915 → 2012-11-08 19:15 on A858's clock
Posted (UTC)
2012-11-08 11:15:25
Timezone
UTC+8 · title 19:15 against posted 11:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201211081915) = 0099b5d3eb577dde9c6f198ca1e47ea7 (name+title)
GUIDs
23
Filler GUID seed
new Random(747).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
113 · predicted N = 23 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AF71F6E80C224BA1 E38726ACE55F8D34 A5F9549788AA2F7B B457045E95379E94 982AB686C11D177E 6562AE3635B4D3B7 12C5697987D58222 AAF4509895BB1292 D5CB409BB093F05E 8D529C68F57E49E4 9446FCFCF29E54EB CEFF2678BE55486B 9A5B08399B0A56DE 0836D8BF5F504F4C 271D4EAD4B97106C 674A9AA9D43D0248 ED946490EF1C5F78 B5695C0FC7E481C1 35D91E5108DDD7ED C7FCE2F3D3AD5A03 9E966A3C860A7F53 0941FC3967988A97 F0C32FD9BED0695A BA01E5F501B7080E 8D600B6B84CA737C 72A8632E5C0179EC D073C7CA8F062CD6 85A5C68E7C5CCDDD 7E30EA0DD38E0A24 5531046735CDC23E 368930F0B182F1D7 65B01E0149F55B88 8115F92B68D8ECDF 367D4DB57861587E 2B2F702A685FABF4 FA10AD1F59374B5F B2A8DC6E48FF5006 513638241EBB90EB D93CE6671309F8D5 72382CE72BB31452 B60C6829255042AE A6B0EF7BA64B3682 5CE8AE122C465B4F 58CF0F8937C31A7F C637F7827C6C784F 3915E095DA9357C6 44C872B209509C41 7E5F07ACC701670F FEE3EF0C3D4E1206 EFA2A617FC9D2F3E BC3A5E893403889A E7B32EBA555C4848 EA3574D764783CC3 406ADD08AB8AC82D 225CCD26490D1A1F 84A52D9C66086C85 FE9B9B6481895B8E 8DE392FB0140BBEA 6A91366A526D2A3E C4FF2D933BE55622 9E6041347A016FCF 9ADCE2806CD19983 307A6D330891FF95 123FE9AC468930E2 FB55878109515B0C 0C9FB93D51B6F927 60C0DD61556183C3 FDC70D9A3E77C188 A9438BEF4C4CD263 602F8E1352345903 3F26FE48186A07A8 632B4CBC131A2DB1 F1F82613D6E2C21A 8762EC5FEFDA790B 84DEE35465AED679 D5DDC9FADE67DF77 C32AE27B4A820A7D 2F5161A11CB3F5C6 544BC1A721268D18 120CEC88F94AA4EB 929037B6A69ABC85 0F3E31786728247D 0D7AA2D460D64810 AE0E3C87F63B7233 5AB5328380369F9A 4A2C6DE09CBAF5CE 5380D9F6D3C0A532 4D5BF1B7DDB8C344 2135AD63190B35E9 4E7D317E20D07335 6055D066A9CFD626 AC895AE51BB9BFC8 455772056176FF24
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201211081915 (name+title). Key = MD5(password) = 0099b5d3eb577dde9c6f198ca1e47ea7, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 69fddcca-dcf5-86f2-8aca-83b340579d18
  2 36685f18-5d3d-07de-aa2b-8450e41dd068
  3 75663788-adee-876d-9fc0-ce48b48a5fd2
  4 72c64093-fa50-00e2-990b-345e9cd0808d
  5 89ea61ac-54d9-42a0-b431-e6d27eb23331
  6 c7db3dcd-9904-3d61-bcd7-c1c731a0567e
  7 1d185089-79cb-5b78-ad41-dca6698784dd
  8 1c20517b-6534-1f2d-80a4-26b848b4712e
  9 06249484-e4ec-35b3-80cd-c2b8a6cb6d7f
 10 9c41c49b-3d7f-6a17-aaaf-a4533f7eb018
 11 eaff1067-b65c-53b8-9f67-e0cbb6a7cde0
 12 385368a0-8940-58c6-905b-e24b6b67d8ef
 13 af2b48ba-1cf3-1212-a56f-cffdc31dc6f0
 14 5ac3bedf-c7df-08b2-a10e-da3dad85e268
 15 a587bb9b-0499-7ed7-841f-80526ca00b0f
 16 b1a37530-1e27-42d3-a340-383aab7ee95b
 17 a88d08cb-1796-7005-aab0-461525a9bb30
 18 9a0c5fae-655f-19ec-9204-e23adf6b9c1c
 19 79cffa89-f5f0-8f2d-8fd0-eecdb40e2c67
 20 a61e6c72-c150-5d4c-afaf-8dcc05985791
 21 6330e90a-3bd0-0723-af26-50689df3b165
 22 a256f814-11d8-1fff-8e37-a984cbe9a2d1
 23 823561ae-eb91-256f-8703-24d4c87704f6

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 80804351365510747185012. Exactly this sequence comes out of new Random(747).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 113 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs