A858DE45F56D9BC9 archive

201212031635 148049

explained decrypted filler

seed 609

Metadata

Post ID
148049
Title
201212031635 → 2012-12-03 16:35 on A858's clock
Posted (UTC)
2012-12-03 21:35:03
Timezone
UTC−5 · title 16:35 against posted 21:35 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,424 hex characters · 712 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212031635) = bff8e67a76a553bc0c60ca4983feb764 (name+title)
GUIDs
22
Filler GUID seed
new Random(609).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
4 · predicted N = 22 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F227FD73BC32F572 9CE6278DF2AA4C26 4BF879DEFB5D630C AA5732F34E57FB32 8EE04ECFBCD68A2F B8CC980FAB75C831 ABBF870791723A22 58863B9A9346EC69 D987ED8B2B9E915C 401172D5F97F3917 49400F375CF7923E 6897180AA79DA78A EFEFDD4596091B49 6E195EC0FBFC4580 8B10E4C94F09941E 8E1D48997DDA24F9 D841665EB7953FA4 C6FF57D9131DFDB8 A0324E8DEE52EA3F EC5D6D411BB5AE26 DCB5C71E4CE5B374 692B721A55C4C87E 4AF79102FC0CC812 45706D2F03E076B4 535FF3A70561A425 2BAA8C8A3952F38C 337B6E07E655BED5 09D54FBB1EC8D469 05F123B8F712B4B5 6DF12CD7665AF6E1 246152E8B4421459 6BA1DB39E8D582CA D6F2BEB0B507AF21 914E4F7194B9B9D1 BE7F85C931FFCE33 24BCB61916769835 DBEC614476A94B85 BA7E1E89D9A44514 3E17DE48E4591BB8 A480590E8364D6F0 C90CCEDADF85435A A06984140D05EA09 A7BD1DA84FA7DD80 ED08513C8B50C4DE 0A05B08C81754E30 1390695F561453D9 F9AE07DE1D148C8D E8479FDE1EBFE84D C7CE9B3DBE1BBAD4 438FFC2BC96BCAA4 F2028059EDC1F136 8929D60422F0020E 2066FCFB5CFE5E76 8CFF78D66C2F74E9 F283F8009EE7990E 31E471CD5A7A5B85 DC406AF0F193935F EEAB9138B5FC9AF2 7BCB6F2DAA1CAB72 08810EE4C1CA8620 77272D8385782175 392951827E68257C CBF460AE74957895 70B77730466D30CA 9AADA21CAD549E54 703C4695C1CCFBE8 7E3CF1520E091738 69023B9085B7B319 C0AE39D9C7509372 CBA593E1BFA94105 732E0AE2A613C820 C1CFB2C7E7AED839 B550C474E971ED12 D495FB18E3A895D3 00528675543F1226 BCFC687C6905B010 5BD9E08A1C9BA3E2 1BE6CFC0B986E682 406FA2CEEF656115 57F784E057C8B357 DED9D51130E8B798 783A4CEA61E06880 B3C753D26F8BF1FD 7415D97C468F0104 12891CE050385628 909CDA033015FAFE AA6263C7A30604B4 A27ADAB1C3117A99 77DDDF49F66A2E73
  • Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212031635 (name+title). Key = MD5(password) = bff8e67a76a553bc0c60ca4983feb764, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7e8c6500-0fd2-7898-8a79-f396c8f951f6
  2 2d9adac8-4bc4-46d2-8b2f-bd3a9c0b4d8e
  3 829669d0-ea47-48f1-a667-b7f460ec6fec
  4 4b798632-c2c8-4c42-bdca-deec6165b269
  5 8860c7b0-e7b1-1f02-96cf-58a0704d661b
  6 528fc786-cbb9-61ef-8320-ae3c264d9ebc
  7 721ee06b-db30-6f22-83d4-6f13eef0639b
  8 370d2692-aad0-8da0-a630-1b0a2e9267b6
  9 e0cca6ce-ec55-2529-abd1-a575783f217e
 10 81c77b8c-839e-74e3-ac54-287f27e289f1
 11 ab13bee9-8238-825c-9181-09de75bda66a
 12 61ffb0ac-923f-86ea-a01d-ee71375f521d
 13 7429b022-d086-2ad6-a3d1-5349e732563d
 14 564d872e-d73c-22f2-93bc-79a85c42c4cb
 15 94fb1814-eca3-28c9-a7f3-b2232d4106b2
 16 f4edc2e9-8035-3701-8830-29261c77299f
 17 08140ffc-cebc-732a-b1a8-853fa3548710
 18 0e1db9b0-96bb-58e7-9152-0d698499fa06
 19 7097a6df-1bd0-1d05-b7ff-45e8b84490e9
 20 02591920-3dc4-12ba-ade4-0ae8e16fe09f
 21 f97af3e3-0175-6917-a8b9-b9bce3f0c4e2
 22 7600cde6-3b52-2b85-a969-cdb47e9c3e5e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7444166827882223751162. Exactly this sequence comes out of new Random(609).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 4 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs