A858DE45F56D9BC9 archive

201211082125 12usrk

explained decrypted filler

seed 281

Metadata

Post ID
12usrk
Title
201211082125 → 2012-11-08 21:25 on A858's clock
Posted (UTC)
2012-11-08 13:25:34
Timezone
UTC+8 · title 21:25 against posted 13:25 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201211082125) = b96595981ac8b64fc7d7a02f49221465 (name+title)
GUIDs
38
Filler GUID seed
new Random(281).Next(9) ✓ verified
Run
Run 38 (seed 1,045,884,937) (seed)
Draw
126 · predicted N = 38 ✓
Machine boot
2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

5B61735592484AE5 0F851AC9FE3DA795 31786ABD4C78415E 9CD27A0C305D5B01 E2761F4A8C9615BE 8F084AECA8A1A944 E86483FEADB39F84 9F802786BFBB4110 70E28A12FA797957 3910306F4789073F 7B68CB92896317C6 E994A971A8DAC273 869867BD505973D6 9C64D88F67A4A710 C8002F09A51E6431 05FF6A91DF7F68FF 2C6AE4291C579B79 D721D73A6F8C5553 08013658EAD1690F AE6181A276908CB2 F5FE48D9175295C3 598F497AF0AE6852 280A96FD54F7917A 2889DD1E13B6AD8A DA9F3A76B4190E7B E33A942BE065569F 5FBF05BBB0490F0F 795F406D4C250330 C03F3199936C6A2A E01976DB610ABBB9 ACFF9FB164DD81CD 7DC20030853F13CC 3AA86123B6707DBA B49FBB1EFDFD062A 3DF78A931F63F288 4FC36AC6526727B1 8EAE550F8879C0C4 731D550094D17779 FBFF9E0B632D4644 7C961BE953AC82C1 A31134694F944B6E 6C55659553840420 25C0C22C29F61BBC DCA3856EC158F06E C6E839C7E7D10D68 9CC5F1E572CBF41E 6747FC11F83BF3CF F6C092420184CD0F 7CD3B32378BE9243 B17F61C49D6C8100 50C99FEF06BFD5C6 3CBBDD174B3EA008 AB7BB66F3087214A 991C7A42F17ABDC2 E2726952BE59AED2 80822835FAAD1C3E BE08C36299F803C2 AF7A7B1C20659013 5EAE101D257EC4E7 0F8CE1DF713693D8 A076A445510E7645 F47031BD5CE89FA3 99BFDF805E267C66 3A4733B20082DB8D 1B9535431F90D638 8F0EC7097F716582 0050D155BE871350 FA4B9524FB063054 B81FDC22ADF67466 9B00E9E30454766E AD12AE49440591B6 99204068D0E2B538 A735AE42C90B6A33 C4478AA06D375849 8A2387C143DB413E AA4F5640A9BA0A22 A950E179C36C8432 73DBD5AA93F1EDBB 0737AA90231F19D8 B9E5F816F2E11F9C B3A3FA7CB59E5A8A 5F16144DFA99865C 584BC967E6FB1E58 A0865B0D3FC97213 3429F5B9E3043C76 0B509E5D7BB003EC 1C0DFFDF770660A1 F87CA6B1B32A38B8 3CAC09D743BBD83B 7BEF7D0DE1EC6B26 DE218E585AB3A341 6EB1BC8190375CA8 B30D98D19A6E24A4 63B3168C902D5B7E BB314ADB7D3375D6 EF231EE883CE760C 39351A62D29963AB 8FB343845429FD4B 178297EAB2559724 E3FC696589192643 822B463E5EF092C1 BBC46ED0ABB07BD1 0ABD0CFD87E7C100 5F63754BC54068F6 52711216657627E2 4FC3A726E4FD8D48 D6055C922C8537FD 7F51B7B11E3D6558 0804061EDFFED8EF 19F8797DB1DB26F8 F1E0302A97A05308 832F97A6701AC920 6F9B10EFF3628C4C 194F71B158DF2242 6872BE9C166E8085 0FD888E0E26FBC7E 5231CC1AE4F837AC 689C2C4E277DD490 E645D77195D04011 FE55359D40E0F8DB BF5FD2454209715A 19A7E5A28A2AA448 F34478E39D8B0027 94F2EE2CDCBACB9A B7B41A6D3381D451 FED1BA3B74180F39 5AC6393E560F4C02 ADE919F8AF773BEE DF322460D36FE5D3 CF8D844C970532F7 BB309B7367D47198 7875C931A8D78B2F 3B00910259723C90 A4E65EB05EFFE277 63AAF377926B40F9 FD88F7F3A75D78EB F3ECD0FF6A24E6AB F2EF78AD7DA1519A 785C11DA763EFBF6 19467004EAD76F99 05A54E438296CE37 08A5E67D18CEC4D1 B26BDBAC9998FCA4 5E8923854E053FF4 CB81E9DBA96AEC96 E41B4A015CD3676B A3482D233B5D748F 7DFAC53CF9E3E16C 34969451F4914B79 823F96DF047C84D3 84C7F03F8C9AC883 3E34F21AF0751C2E BE887C496E62ADCE
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201211082125 (name+title). Key = MD5(password) = b96595981ac8b64fc7d7a02f49221465, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 aa0d8eac-ba4b-4ba6-82f2-41330e8b76fc
  2 b7484034-ba45-24ed-bfb4-6e6b47c105f9
  3 8e5f7106-0f24-1114-9aed-f39abe46402b
  4 6bf03a65-1460-4c59-a1e0-1c0a6d813bc5
  5 caa66b2f-2bca-05c5-9418-143f6386451c
  6 3015997a-096a-1cfc-86d5-92505d6a2f61
  7 534563e1-f640-7b8b-b20d-b4b14c4c5392
  8 36ef7799-e6a4-3915-ac19-1befdff65997
  9 8f96f764-18b2-6122-bce3-d1fc45e52c45
 10 a37b219e-b3b6-834d-9611-f4b32ae53924
 11 0f42b248-234b-2bee-bba2-eb3f5c851bcd
 12 73d40a59-1c84-7eb0-ab17-0b56d1ab4798
 13 87d3147d-1f33-7eff-a381-29289b615e22
 14 89464252-0a68-584a-b3c5-61ed26853d2d
 15 37dc6bd0-2662-6993-97b4-cc95a3c88662
 16 707b9cdc-7dda-4a36-8873-3bb6419ddb5b
 17 c4742593-81e4-8f76-999b-26968b0900fe
 18 e4760458-cf7a-129c-af8c-73086b184f59
 19 2de69992-45bf-2030-b227-b3513c34c58b
 20 736c483c-3efb-1086-8469-f4fa02420e70
 21 b103a503-613d-114a-9f89-1d91bf337256
 22 f83d62a9-93af-7c39-8774-bceffe8f25ac
 23 9a32bb80-6d98-4864-bfb0-9b9b6de48c5c
 24 c78e0c01-0b99-198c-9834-529f003142fe
 25 be05f1dd-2d86-2cc4-9ec4-1fa738e241da
 26 41c332cb-d756-266e-8608-2cba08734704
 27 f2ac21a4-6e40-40a6-a66f-75caf722a2c9
 28 c6c30052-8cd7-70d6-b184-deded12fe94b
 29 a0fba5a1-0b5d-1326-9bbb-c0457073c0e9
 30 e815e56e-d7d0-393b-8b92-515ea20336f6
 31 985e6c02-e169-8a66-a0ac-1edfb93ed139
 32 4af8b518-8fa9-48bd-b261-5d4ce050896c
 33 4b4dd980-3ca5-2204-97a7-e19aa67ef593
 34 d5eff34a-41a4-0138-8da7-9a922c0ce202
 35 69a8946b-db97-6826-b238-703653297697
 36 97d4e52b-e4b7-8a95-8708-99830cd83b74
 37 5b96a463-13d8-7eaa-8e83-be0e22ecc2b0
 38 6e3c86ca-f28b-7c2f-93eb-fd52a5646d75

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 42140173682775648121174122471384206877. Exactly this sequence comes out of new Random(281).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 126 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs