A858DE45F56D9BC9 archive

201212032205 148o11

explained decrypted filler

seed 815

Metadata

Post ID
148o11
Title
201212032205 → 2012-12-03 22:05 on A858's clock
Posted (UTC)
2012-12-04 03:05:10
Timezone
UTC−5 · title 22:05 against posted 03:05 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212032205) = 8872e3a09b95d0a7fb3a5a3f96732c53 (name+title)
GUIDs
38
Filler GUID seed
new Random(815).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
14 · predicted N = 38 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

652DCF47AF4CC772 5C934EABC5885168 6E690905323989DC 479CC10559A0E19C 2F569FEC475AE588 F4311BAEAACE49CF E9AF112D321A5E27 B7BCA7CA17D7478B D6130AE16A0D825F 6DF5909969A9AD10 554DBCE3259067A9 45506408A4C93E35 3B3400BC16DA4CF2 0BA4C391EBD8FE98 542E51229059447B BF7751BA94045EBB 24CA024B4EB059E4 5011CD7CDF12CA09 220B64EF49717CBF 61FACE40E70F1265 9DBB9B25F4599B28 46DF00AEBC045B94 3187264CE02A5938 F485FFC7D9CBE22A 707ABFDF35AA2F8A 56E367E85BCAF6A3 CCCCDBC2A7FAD894 DA99CE14EB76F4BC 19FF49D4C4DA3701 3DD6CA8BC5F64B69 BA4C0D973345FB6D AE73A3FDA5E89F18 5C7AA7F8E2406F63 77D63BE8ECA351D0 31D53750A4EDC04E E942E5DE8BF073E9 6BDF970223A5C612 793514F15FA228AC 2EED5FCFAC68D4F0 673EB8C041C1B9FD C4E877480049277E 93F06E11095C3F79 64EBB281FDFBB88C 35620F5AF98D8D4C 0A53D05B0D94315F 3FD1CA6F7652B7A6 E828A7A17159A6E8 F2AB42850BC1B447 0018B5B38878C4E0 D7C62996AB5046F8 358E36549B53AD02 45AB807F1AA82867 56D67A5E91CD7F4F 673005EAFEC0DCCE B389D51E41A93334 728D71429BB54B03 CB6F28C1990D2513 F318393AA259C61E E09E593ACE98CAF8 75A503E47B2EFBB4 394AE3CD7AD869E1 189572C6AB9781DF DF27A9CE85B1A36E 8E5951C203264FA1 FE6293E8F1791211 63D7780F30018354 7DBF6F604265C5D4 70EC8105AA39B907 C82DD9A044385E55 DE26875661AE21F5 E1A5CFFE355F74AA 5437DA3221C4F0DB F9C056D54800B837 948AD43F80C997CE 0EAA7577747F75A6 FDB88835C50BC966 3FDE50E36503ED8D 60BEF0A2DF3F8647 7694F8CF762D4708 0215BB309D1B4954 45FFDAA69C02AEDC 2F5FA516B24FC5F4 F4DB39A5E4986242 9A6293D9FF01AC9C C06A60FF1107AF15 5163132F03C4CC31 F4AF102D8F600EBC F0AA1417CE175D8C 0061642AAB1846B2 5EC4770B6B013672 8D7532DAE1A2EEDE 9F232BF74F4AF311 47F0E517A270CFB0 D31673A789F6F3AD DF98FC42CFD92B53 05021D8B24450472 88F6228711E32870 0BAB36115C5A962A EB5F662799D3CCCF 5C40A88659C45177 1708BF044C939E08 5BF9AEF3DFB542AA DA3A12A190295258 1F6E65D5C16D73B4 09602A86DA988C77 62E501C09B6BEFC5 67885F02E011CE58 B0EF14E071BE35DA 879DC49A7801A632 F491226C34DD7067 2F9537BD73C143BB B57F03D0C3C25C15 665B6CA39008F136 A7473B7868BB2B5D 3D194E072967B05D 21912A65C7E00FAB 9B0BF3C411975A4F 55B0627CBF03521C 361B9B9BD605FB83 AFAD4CA4573E5B20 536F6EF2C6516AA6 7B1B422CB2F2DB7D B9BA8156B735AA8C 50E611255C9EAF01 8048677D5967159F E743C491472E4684 ABAEF2249051CE76 526B3F2008AAD34E F2ADC17AE702F966 62AE02CB3ECCD16E 989983A2684CBFC9 F03CE7CB5FFA31BA 83307D36A0FC1FE5 7EC6D3305F9A3EF3 2BBEC646DA8AA93A 47CB46331FBE28E1 DDFF73C8B8A0D315 8420B1F555A86BFF C6146C84F2CC1310 27B4BD187C764773 E6A76DB7DB84F205 1381051079516B74 C37A8B3D87EDA8EA 9BFB63870B2B5259 221D906AEF6F3C68 C2E444C2E0EDB694 41431DE377975DEB DC4F1040D55D079D 914BE3E91FB3B171 87B97C4E7DC63EA9 46C8C26CFB731FED 88B2AE31A8AAA078 6A4804F81319B64D
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212032205 (name+title). Key = MD5(password) = 8872e3a09b95d0a7fb3a5a3f96732c53, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 257e1dbb-81a3-41ed-87ac-707acaf19aaf
  2 f6ccdbd0-6647-8265-b16e-c52b7c544111
  3 af2d7517-b97b-310d-a11d-48b28bb9d2e0
  4 f03e0b68-a3c6-4212-9f32-d00d5ca0c78e
  5 a882e9cc-d3a0-12ad-bc1f-22368bd6abb5
  6 b40b45c8-0e4e-747f-afaa-f825b3fc8d27
  7 5c290f34-5b79-0fb8-a798-6ec7d8cc4cc5
  8 dac1cb20-c43c-2fa4-88da-44f8cdb116a3
  9 70fa5d2a-b6a7-70e1-86a0-fcb946bd0d1e
 10 d9259952-05e3-7df4-83b4-9d9fdfa832b0
 11 860fcb33-253d-65b4-b787-65988bf3fad1
 12 a00de185-b4f3-6cd8-9d6b-cc3b34523d74
 13 29e62f2b-5e9e-8a11-b750-7a9e9b986891
 14 162d615a-6e20-4627-9c11-7cbddc019c52
 15 97d640d2-eadf-4445-a241-47a2c85b5246
 16 5399baaf-e92c-0190-b7d2-7483030584f9
 17 2077cf3c-a182-43f1-addb-47177946a369
 18 69a19edc-030f-272a-8b23-77ed0fb6bded
 19 59577b25-fc7c-6a7b-8e43-b4c039170b05
 20 bf5fffc4-b233-7eea-b10f-291880b1b760
 21 b9c76f29-e554-0cf0-b92c-1daf7131c21e
 22 b7582814-df95-7483-97d7-9f5e3b9b3b59
 23 12867d87-f1ac-60a0-8373-75e60f602217
 24 e2f140b3-5335-6327-acf4-c426a41801a8
 25 89a8893a-751f-5d26-9e21-96636e6f67cb
 26 e49261a9-73be-65af-b83d-b08488d03b4b
 27 744f20e8-8ce0-5b14-9f8b-f1f5d415834c
 28 32144c70-83fe-6225-8be4-750f5c9262ce
 29 0c0f9bbc-1fa7-5342-a3f8-e9b43e400dde
 30 8f25fb3b-a3de-484b-b54c-0c235db0aa9a
 31 00170b7f-6fc5-038b-867d-9ebff5774f83
 32 e32d3f1f-3fb0-1fe6-a137-8f8f15a36a5b
 33 b833f0be-bd22-02f7-839f-3527aadb6885
 34 b1afdee7-cf97-313a-8f64-460951f70b51
 35 aa4c67cf-693d-2de1-9e60-5a67b8ff5ac5
 36 8f4aa139-b226-0b01-bc9d-b32fb0710e34
 37 faa764b1-3797-19d3-8f6d-6da85d7cb3fc
 38 4f15f8e5-f26a-706b-961a-ffd9d650cb2d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 48341702776684404267076656565401032017. Exactly this sequence comes out of new Random(815).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 14 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs