A858DE45F56D9BC9 archive

201212032059 148ja0

explained decrypted filler

seed 588

Metadata

Post ID
148ja0
Title
201212032059 → 2012-12-03 20:59 on A858's clock
Posted (UTC)
2012-12-04 01:59:09
Timezone
UTC−5 · title 20:59 against posted 01:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,424 hex characters · 712 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212032059) = 68b3274b5a9be91c918589b53ffca91d (name+title)
GUIDs
22
Filler GUID seed
new Random(588).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
12 · predicted N = 22 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7B22BB88046169DF CBBECD907E33A145 DCB35169BA104A2F BF8322B05A8283F0 3446CA943DA58540 300BED73250E6A26 B6919548B142FBAB 8ED5868698AD1AF3 EC55B58D0DF84AB1 52FA91785D00F736 1EECC262462BD585 19049537665BD433 4DA90B6F1261CE8A 33A48C8109E11C6B 83F4E4F209591BBD 7DEEA9D5011E948A 81CD994F32BFA1F1 59EFFB8E1E70E477 6D89ED660E94F748 56909B3190A64C12 15CD1E4096FB1793 D4D855B65FC86FCB 82167C92A10BC43E 51A229BD6B84E71D 7709E6F38041C6E4 EC56112C995CBB31 F3D5BD091EF845E3 5C08E8575CCA2A83 7D40611116B7DCF5 49EE3BA5E881CA7D 8529019FC3064E6D 95FDC9E9B3C95845 B7510BA1553E8BFA 3E371617ACB49D8E 66F4B6E010291BF2 A1E31399DD3C97D7 D14B2FE5C853E21B EA533CB7C0965B82 BA0969C417D9EC85 07B1916C3794EAF8 510954649DD0887E F4B4735D6E962093 71EDD4280B80F8E7 57EB962C4A851106 EADD33E133D10FCA 85CC6874ECA7D752 751828D96F7F4B1D E96C92F08062615E 2A2F757028BC24BE 21C02CB2C4595164 87DB46DB4A4A4A13 3AB14C54EDC60EA9 1980C119B3E3CB0D B68B206762C4C71F F7874CAAF0441143 C0CCB0E2A3B8F819 F9AACD5869D7E15C 3DA5AA4E58ED9D25 C59F9E7E6056E6C8 38808C0A9C442448 42CF0B01E3E3CB2D 7A55CC5388294D75 75E3973C79E08CC1 89737BA14CFA5F94 E3EBCEC7E6CE96AC 3DB2B14EDA858E8E 44A364B0E892904D FC57CA59004DF862 9B875DE40981FCC9 DAE3077F04BCBC0C C29601E96BA5C2A2 0423C87B42D866D5 BAF927F854123603 AC4683702C1EED44 50E535161C6CD597 0FB32C213842AC91 7689D47EA60ADCBF D5E2B90AC09B6D5D A2677A16FE02C567 F599693A399053EB 7150874E5F09C9E4 322EB3EC07452D82 7FA142C6E04101CE 1F6990520CF26394 7D61D77A327D4C8D A131FA2C5412B4D2 794FC4DADAA7BC9A A53AE64B662E1C22 6A788318251409FE
  • Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212032059 (name+title). Key = MD5(password) = 68b3274b5a9be91c918589b53ffca91d, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 70bad5cb-d298-8778-8e8a-14635b7c442f
  2 c0c780aa-781d-3bd8-8a32-7177faa72538
  3 35089d1b-0a34-65ae-b05d-7b1172fcf2d5
  4 6e162852-ffd0-0923-88b5-daf2f1cee1d9
  5 76c2fe93-ee71-6b45-863f-46dc8bed3bf8
  6 9a2a54c3-02ba-3945-89d4-37dea14ba979
  7 a6795cab-fbce-3c7c-a7b0-b9abc638b1f2
  8 d880566c-d8b2-3f23-b280-0b945d36b08e
  9 d14a48dc-ed3d-6ff0-9af0-8ef415165aa9
 10 fab28e03-2af8-0282-844f-bce16383b9a6
 11 85d6e10a-72e3-4103-b120-c6a61ad101be
 12 7af86637-4cf9-4aa7-808e-c64ff56b84f7
 13 583f2543-6a76-7ee4-ac6e-f8bec7fa8a1d
 14 09a22b16-11c8-33ff-a6b1-286600b82e48
 15 5da6a4a3-b0f5-5b69-bd8f-1579bb7b16cb
 16 a74536c7-187e-2fd3-8408-b629ea7932e6
 17 a08a38b3-4a7f-0e98-bf12-e08eb425d958
 18 c45a3ea0-9a00-4e34-b29f-7534d7f481c6
 19 a26743c8-3c49-5311-b20d-49c6221c35d9
 20 30b0546b-254a-8745-a8ea-d031c76da57e
 21 0e153821-8d23-8636-b148-e8ad2f4f4aa8
 22 598da4ff-2c9c-0592-b01b-f97836ec1206

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8360633360447352045880. Exactly this sequence comes out of new Random(588).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 12 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs