A858DE45F56D9BC9 archive

201211082105 12us25

explained decrypted filler

seed 819

Metadata

Post ID
12us25
Title
201211082105 → 2012-11-08 21:05 on A858's clock
Posted (UTC)
2012-11-08 13:05:33
Timezone
UTC+8 · title 21:05 against posted 13:05 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201211082105) = 875cfe20721344e6da8260ce7205faf8 (name+title)
GUIDs
16
Filler GUID seed
new Random(819).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
124 · predicted N = 16 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

977FF3162507DFCA B572D742CC6C6247 FB16390BB8B76B68 A1BD56BACBBF00FF 98B321A0D0EC94F1 6955F65EAEA05C11 D1A837AEE11B9DD8 C92182BBCB3807BD B25F9B8EE2A15A3C 6A9B5E0D6754A9B5 D44D055171F05AC5 98F592F42F017080 344D4D1CCE74A9B3 B1B49382DFA33610 3437DB13BF1AE36B EDBD031E6B7BA916 57E56CC067B752FF 8F1B14AD1C68075D 7C87708CA9E92FB1 F8AAAD21407C887A B2463B1E704B6151 2B3F5B99AE4EAA69 A94E8002D84B537F 6ABF5D2F303BDE37 83D39A2CB6E5420A AB7CCC59A26AF258 747DB603C44E5686 DC5CDC2EACF6C9B8 F882137A0C2A4B9E 5AD84DCAB42910F4 D2B7AC07DA25655D 922109694D938F7F BB6385CA39B349C3 CEDDF6BAD698322C 3FE3F273CB942516 C1C2C04F906DAE34 66F63D883606CC11 AE42868BF7874B15 2ECEBA4E3AE04431 4211D9F278164BE3 0075E23DA5552382 4D80F8CFA213CB18 825B6091A4FF47D4 C5AFB45148542B59 811C88400E3A2125 B30F1740536B6BBB 0A0FDCA9ABC0AF48 8325879CA64C4519 42F2C7E711026F02 66EA9E7378C5FD1D C666E3AF887506A0 4179E9DE5645A424 65AD5E36BEDCA9CE BE1D740B9401149E 485739C44CF856B9 46C35F0185932410 54C9BC644C455C2C AC36BD04A3EEBE04 31322BC18CEF04FD 32845766603E5B94 DE9E8449EFDBB2EA 4BF5B6239995DD3F F0C2073974BCC394 89047837BD6FA6E5 4228B4D66381AA7C
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201211082105 (name+title). Key = MD5(password) = 875cfe20721344e6da8260ce7205faf8, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4dff3b70-fd42-501a-88e8-fb9edc7c441e
  2 c759cb15-0f30-166b-8813-07493ecc9b2d
  3 e950d806-7d35-2002-af47-4d3c1dee4148
  4 105dc8ba-d7b6-3634-b38f-6a073606ccfb
  5 32c09a6f-f7fc-86be-ab01-b8f91da1918d
  6 9fd60604-9fef-2ffe-9d30-a69815bea5bd
  7 ecd21aa2-7dcd-76b1-b660-bebc8a6b8099
  8 e8437f6f-1be4-2a39-9079-193b750ceb15
  9 b5c9a841-9a6e-2723-84dd-126556f4038f
 10 e16488a1-500d-2a50-8689-49ba6b17dc64
 11 08c51dc1-ca50-6767-9104-00597af9570c
 12 14d72a46-0698-7ffb-afe7-35c4c4a6cf83
 13 08b80c6f-9cf6-5f85-bcdf-31180f47f174
 14 98613ddf-0019-5dfa-878f-7a85cc1a7913
 15 aa5441d4-dd3b-2859-8b95-739d8ac02675
 16 9626a9e2-4138-466c-be73-16f181a6d860

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5123827222675524. Exactly this sequence comes out of new Random(819).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 124 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs