A858DE45F56D9BC9 archive

201212040302 1494gz

explained decrypted filler

seed 933

Metadata

Post ID
1494gz
Title
201212040302 → 2012-12-04 03:02 on A858's clock
Posted (UTC)
2012-12-04 08:02:16
Timezone
UTC−5 · title 03:02 against posted 08:02 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212040302) = fe66b11a05214234cb981c2f937a0065 (name+title)
GUIDs
23
Filler GUID seed
new Random(933).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
23 · predicted N = 23 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6B9FC05213E62561 905E73E1611B0B25 D55A73AFF29F6093 6B7A0BC808C44611 974CF83E71F92482 BE19544F22E1A9B0 8AF3EF8AF640E430 2B21732C89E96F42 CA4EACDDC21427EB 61E7342814DD6323 C63618AA8937459C 9171B5662CE6F8D0 2DC089A4F4ECBC77 6F8DDC3CDFF42F51 6D037DC4FA9BCF91 DF4AEA8AD3B90B5E E7037EE2B9D55927 4165D243C43DD302 A7F87DDC33FE3F63 1319C810316BA698 66FC99439CC691AE B39CF876F9E2A517 92ED5032DBEB3D6D ECC909EB021E02AA 6A1C51E8BA7BA0F7 5F232B2830A720BF EB6968D75EB1F8C9 D08D74F5A9B98F6D 79EBB912309DB11F A860750E2F3598B2 7F27BCCC91FD6339 8136053D6E288E58 0E8CF5547943F140 AA2990F2B168DA6E 7078EE791CAB3719 7E842FE7E45F6B16 FEE9DF42059182E6 1C64FDC596112815 5F9F5A4D80E72C6B F696964E34FB0F57 E6F29EF6EB91A231 8284931EA0B75C0F 2D44C01EC16B8E43 0C97403351459607 28FAD982A4A3978A BE44FF676F5945CD 068F7EF6714FFB8A DA38A2F2FA6F3980 648C6EF4C6B2460A B83AD7C3A2A4B2C3 5B5901578F00F7D3 C91E2E44AE99648F AF45A9D1F4586DFF 1D8BCAF67381C1DA BFAA0D79781E0B62 DDF1C8A752F179BF EDC0AD4434907999 3EC512FF33B309D1 62D15E7389C7B9C6 0E51E89B61CC8D5A F2FE6998F4433058 9F8248D23958DCF7 DF227C5313D349D2 3884A80809C81262 F72341167A29B54C 2A21D886650C4C01 1524E046A9DC715F 945B10FD89ACA893 C48E5947C5D23DAE C387BCC3775F6AC8 7C176CC22876DD89 C80A69B98BFBCC33 E08D720AB90A7314 EF23FC3219CFB82A C4F4129BC74EF09C 065610762CAB3063 53BEE57EB86D5DE8 390427179B6BFEA9 D621D131747C71F0 8CC9E43613D6CBA4 AA747C39C29F484C AD3765AE9FD9D6A8 767C0D0BA50B8ADE 215B14F3E2AFBBC5 BF4B411B9447CB6B 5906D2CA815750FA 6B6311895CF4FCB8 8A0A7EDCDC06286C 44CA9D4113099756 AE9F89EC9D28B638 8D4FE823AABDBE2F 8498D452AA7B14EA 4CA2F3ABEEAA8DA6
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212040302 (name+title). Key = MD5(password) = fe66b11a05214234cb981c2f937a0065, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e91dad6a-0012-1ace-88ba-09b17670ff95
  2 9e553a4a-3b47-598a-a8bb-2b0445166dad
  3 f225e0d9-7f55-8cb8-b37b-59ae347d1811
  4 d5b6efad-ba9f-66c9-b9f4-25394c99f1c7
  5 5acb56b1-a8f5-385e-9f7c-302dfcf2cf59
  6 fa25f041-8e5d-807f-97f0-4bb89e37b8d0
  7 2a02c375-32b8-8467-9a3d-a0cce188ade2
  8 843ef0fb-dcae-42ef-8c8c-d847c2a001fa
  9 8fc465a6-00f1-3d4e-9c1a-39da37e1e459
 10 d8af8a0b-3118-286b-8c99-13583477794f
 11 e1206de4-6981-547b-9499-c6803de9478a
 12 865ffc91-cfca-7ad1-85da-978110905f26
 13 758295f2-3433-00c9-9541-cef62a8822b0
 14 0e02cb5a-82b3-7371-9970-99937c87ae4b
 15 b9b20aa7-db31-080a-bac1-3c6df80034c0
 16 5cb088db-6361-6c52-8004-79bac19d560c
 17 39d24272-40fb-00cf-9d0f-3ffb40d26953
 18 ce4c9aa4-77cc-4ed6-aaff-a7c489219220
 19 7042f4ac-041b-85a2-a9ec-5302356bb822
 20 2c9d53de-3f0e-536d-a367-2afd9a6ca413
 21 93ccc730-90f7-71a5-b135-de2c49a9b2e5
 22 e6836f99-999d-6bb5-8621-887fb27ac321
 23 4eea9b6e-f833-630e-8485-693733ea228b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 15863884325707060485766. Exactly this sequence comes out of new Random(933).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 23 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs