A858DE45F56D9BC9 archive

201212031456 147sxt

explained decrypted filler

seed 688

Metadata

Post ID
147sxt
Title
201212031456 → 2012-12-03 14:56 on A858's clock
Posted (UTC)
2012-12-03 19:56:01
Timezone
UTC−5 · title 14:56 against posted 19:56 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,000 hex characters · 1,000 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212031456) = 97ed59cb2820b0b167a622508947929c (name+title)
GUIDs
31
Filler GUID seed
new Random(688).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
1 · predicted N = 31 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

335E4F729169A54E 600B16C9E31C29F3 651344CC757F212C 5B6F4176CD0EEDF6 416F23B0D69756BA ADD60E618AE9BD71 93D4D1A63ACDD99D 9052272487E8BE77 45B8855C15EAADB4 7D26CA06142FAFF1 14168A1CF885F08D 893587CE86560BAF 52F48FCF24E55808 073C0DFDB084461A 294CC5474BEDEA92 0935FF8DF98F65A8 AF7D8ED9567A559D DF4FBB9A3AB7263A 1B61970E4652FF2B C5FC0473A465A21F 35AE14EE6E2CFF06 8189C124103F8498 AE521359BC897D24 D41CD0F9A60DD6EE B9713AD1561AAC5C 07FC89DBBB1A00E5 CB2D23C0F4D2F3E0 CA6A08C28EA619F9 FE1CC0EF5DE0EB26 5E0DC16C158CDFF8 62596B3A42ACAFCC 76A858CBB1DAB743 6397F711A0C760DB C8CFCFB844C9D6C3 E37588605BDA37E0 18662E80B40B050B C6CE5CF0E8195AF2 84401EC1561491E2 1D0D3B3880B72928 DC896A780DCDE245 FA05C3A9630DB68C 70C0C50EACA46BB1 02B257719EFBAA8F 65A286CEF7AB21E7 2A726C92909E2EFC 59B890C6F717D96D 5E4F2062E59FA8F0 18813AF542355C09 B859537E66D57CD2 BD017BB06DE3CE3E 776E6D3C5196F834 1E7EE93E7ACB4334 9DCB708D9CFFEF93 4326EDA94FE6A6D0 BF78515B426500A2 8D0783A80869AADF 9962115214B7905D D1579414F5EE5B62 C407A402C3968F7F F6722B90289669B7 F4801E89D212DC7E 917E7AB8D974158B C7013E831ED97932 0E05B05FE0D6B570 E0C9111AB6A1D97C 54A4F60176FE974D 49871F8F50F788FC 6A704E719D97985E CB9898CD782144AB 46EEFE2E1345323A 3712290A82C29709 8280269FDE482214 EADC3A386D1376DE 6B14CFC338A2280D 62B1082B4877FABE 0E69E06D028889F4 A026A1A2DAB50BD8 7B22F526E10968FB F05E471FA996CDBB 63096C70EFD8185C BAF4B4C83AD80801 5FC30E4807A743F5 205EFD62E50AA18F D208C9D31EF38E19 513ACEA60332BF76 095B0853BEC05E56 5B907721BF704B52 89543D2FA2D553E5 20294F3AF491F39C 61CF5887B28DF82A 7662E88A91446FAA D13FCB4AADB51F79 430CB87576C8BA36 117EAAB0A2E2377A C4468295134E2B29 D735A5A68F10A6DA 567B13337FEF4591 E20AA807F5AAF9F2 0AC60E99B519C37D 8E4BFA627396638D C516150DC9F1C6E7 799E65357702FAA6 200DCE3247208207 60F9EEC17DF8DAED AA0FD49D6F50FE4D 8B0F28222FF02F6D 6BC007BBEDCCE961 53F34E41E1C7C8B5 6CF92C0CBF3031EC F8B033C352936088 6BE09E55D9A7752A FD468AFB8781CBE1 28F4C9A89D5C7A90 49B965FF5F3BBB53 17C942B48B7D1351 36038B5A236F27BA 273AE23D03908CCB F7A0FC3BACBF954E A6DF7ADC93B27069 D67057C57C927393 A7A885DC9FEFC163 08EEC2E03B8AEDA0 15D3420E4AC2EB00 C934550E65916A69 B4BFC0E3B4467A77
  • Read the ciphertext. Strip whitespace: 2,000 hex characters = 1,000 bytes = 125 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212031456 (name+title). Key = MD5(password) = 97ed59cb2820b0b167a622508947929c, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 31 GUIDs as hex (shown below).

Decrypted: GUID list

  1 780f55a9-f112-196c-8d9b-e5ce064d1b08
  2 544df503-7952-6ff8-b6b3-a9055e4be2df
  3 18de60b5-8d2f-6e80-9a78-abd5803749ae
  4 5169653b-5d4e-3440-ac8d-16bc74171cfb
  5 fb434004-f340-7d2f-9daa-e550f9cf28c1
  6 2ff96159-95fd-7653-95c7-840b59ed7249
  7 8757f969-456b-1fa1-8c93-4f9452524779
  8 14f1029a-9d64-5bef-bd60-d39a4809aa94
  9 f2316bd4-8232-033b-858e-af4ed68d6475
 10 23590a0b-b139-8f0f-9d78-71194e801314
 11 21078b21-8c30-1bbb-92e5-92b82127b328
 12 1453df11-0155-5d47-95ac-e00b8b425dca
 13 41b61632-f9a2-5e26-a50a-436c9703ef95
 14 8cff325c-f4ef-33a2-80b6-000c3096ed0a
 15 826c942f-512e-542f-bb40-5b899391a6f6
 16 b1742700-efbf-6c12-b500-278bcfc462d1
 17 66508720-413a-0d5c-9d17-542418401daf
 18 c9f0364f-d4bc-441a-a14b-b97f9fcf1e8e
 19 d486b65b-6f8d-2a24-afb7-de1fe23ad543
 20 af4c4fce-6f58-6dd5-9414-e794c1f00596
 21 ff9e41f6-45c5-2912-9281-7da5b067661a
 22 cb4eb6f8-260d-52c5-ac2f-c2251784702b
 23 1cea43c3-1b4d-28ab-937f-91c842d6f9b5
 24 25c13638-0db1-3555-99c0-7da8f1f69766
 25 0670506a-b189-15bf-9ed9-c84a2d5d05be
 26 47c160c9-1810-0acf-ad23-552b09164677
 27 b93fd6d9-5cfb-44ac-bd2b-7cb9109e8306
 28 872644c3-7647-8b89-8cf9-4e20c3a6f010
 29 2110f0c2-4d2c-59bc-a80e-9142b874e4dd
 30 c5a3808b-2e22-1f15-a212-54a58b667d9c
 31 e10e208c-acfa-13e3-bf07-f70e10e4a9ed

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1663771508155356042625231048511. Exactly this sequence comes out of new Random(688).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 31; the post has N = 31 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs