A858DE45F56D9BC9 archive

201212040759 149d62

explained decrypted filler

seed 214

Metadata

Post ID
149d62
Title
201212040759 → 2012-12-04 07:59 on A858's clock
Posted (UTC)
2012-12-04 12:59:21
Timezone
UTC−5 · title 07:59 against posted 12:59 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212040759) = d3f0d6d525206655c4e101ecbd7a52f1 (name+title)
GUIDs
38
Filler GUID seed
new Random(214).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
32 · predicted N = 38 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

EA36CFB497849745 82C9C85A7F7BB1C4 C9AC60C47593D78C A08212AE5D897500 79DFAB93C3B3CB01 49B9A4381086318A B8A0D53B4C4E2ECD D4DE90DB36B0F0F9 FB0D0A7B1D6271D3 45A01C199AA4AC1C 666B8FD826D58E7F 372385AF66C84999 6B634FF5E5A2503C 44640562B84DE5F1 D38B458AA6BE233F 7002BB2204FAD7EC 1B690117EF225AD4 2AD406E483E6C5B5 04CFD1275384B4A8 E63D39391503F6E9 FB0F45F6D6BCA6A7 7783CA49F2876E8B C446188D1CCBEB3F 5AE804818BAEA898 DEB5EC4DCA0B6DEC 204D9FAEF030DB6D B10396697B54E3BD DBFEDD1200728C28 6A2608B64C134A8D A7373B600F6B4E72 9D46EEBC49EB591F 2115C2DF17A8B9A0 A22656C350346C72 7CFE441E7C8B6CD2 47E816E33BE45C1F 5EF94B830B771BA5 636A5E5E0E633EF0 D058A6A7A036D679 67EECBEEC03D1CF3 8B7475AFF5D67AC7 5F76AAB6CC23F505 D8AFD02ABDB29813 0F5E0EB6513C3739 3676E782D308A123 13391F9683B00A34 D8C9B55D50B84D6C E27B25E88BE19D29 966A4BA45B38881A 7D4BE2650DF52D81 44058F381D51189D C94A846E07540E92 FE9BEF52D77D7214 75EDAB766470232B 829DA532473AF5E1 1BA95C47ABE25B4F E4876FA8B672391D 9BD1097435BECD58 31FE36F6DD425D07 DC1A6ABD9E26593D FC082DA9BAC4B9FD 3593FFB1D3DB0873 BDA3BAC9B72EF0C2 F6F6AD6237BE8436 C2B98D8562B74CEA 90B792EDEB6F45DF D6BD3B0FAD7B1C39 C233C3F5FAED2AF9 5810E08626EB5BBD 8D5F407B7A5321C2 7D20DE9FF373AC17 0BDDE35BD4945CC6 48B961FD30A262E6 547BF21A2799B68A 5F8AFB7816812054 C3A12B0D32F878D9 1B70826CA81AD796 B8C87801897B5B32 56FDE0389708D9F1 4955FE37BD1739B5 D5D494D13D67EBCC 4045CA38ED5CBABB 8E60ECB91561A775 753C7CC9049BF456 1FE633C8995B0C78 5A2C356E3AA2E3AF 49CE11B5B508BD52 1689360658816270 349A52C2F0A57472 CAA8B8B0CF63F381 6CD519FA7B7C7679 D294D9BC8D708544 BECED60A87EE7A90 F004A8A4F8B8F254 A9F1D03BAD6495E0 6C167C3EC286961F E3D1AF8D17FDCAA6 96A08C792FF7CA74 4DE70C1B4B8C0763 40B315393A7A79BA 9244CB0302E21C4C F1448A89F03AA238 8B9920C8DCC0F0FD 19DA1599D179635F 4DCF1E41EF300A4C 7A6024E9F8498199 2B301E00116FC3BF C9B757F9B2E50A49 E616B5C462073243 511FEAA5A82DE01C 281E7C8DC1A7DD5F AEA6238FDDA508CE 894040E45C7D52E4 84B6B48C82C1CD7B B810834FBC70E9BB 1E18E782185D51D9 EE6A53F5C27841A4 CBD3D2255575FF59 A5FF1470E52A13BD AA43D1335387D912 F0D082DDC09B1A77 FC26958832C95F3C 34203D630B59A3F5 47C27809674D9F3E ADB115C51A68C10F 4B12CDB3AD1E2A88 CF09FAA731DA2434 1C3684AA24D95870 CEEFDA2843F09B33 2A50F1C9FE9DF588 06FF193AFF94B567 A5A78107F5E2CF87 FECE63DEF34268C2 14C64BCBB682A4B1 C13484DFD8961990 ADA35F82BD0F6DFD 20DC7F15AEEE5325 40FC31E200849A5C 112DB4D3EFC25CFB 3F0183EBEA82F829 3EF4053874C5885A 810F13C257D7297A B3F3792D298093B8 176D08E154794D78 D4CC4665982097C9 6533FD99C68D9E46 47A712CC3ED23C71 E10494D052C7A5DF 6BFD151324E44B6E 925013DD2FB45768 F74D633164F80CC6 C5272F28468BFDE8 CA989AB267304447 A45D674D2225370E
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212040759 (name+title). Key = MD5(password) = d3f0d6d525206655c4e101ecbd7a52f1, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1bea3d1c-eb2e-4cef-9fbc-326cb177f1ee
  2 32a76cc6-67ce-5792-9526-36efabbcb310
  3 2a2b5f8f-f396-36f2-94d3-f36209fc8f89
  4 2aeb1d79-8674-20f8-8252-0aeb8614e0cb
  5 dbff8e56-4684-7914-9d0f-d50b0e11b7ac
  6 f8f892f2-9b93-58e8-9452-ce5c3d608948
  7 75cb43f2-f059-7841-9692-5b4faf0d7a81
  8 1209fe79-050c-7da7-abaf-ce4c172ab981
  9 6740b322-948b-4a9d-852c-247868767ae4
 10 6a9a6c2d-d380-1977-b70c-03c0635586f4
 11 3cd295b4-779a-8760-89ab-c0d9dfc2cf7f
 12 8fd6fa7d-ade5-46b1-a97a-488922b26a7e
 13 aec440b2-ff86-6848-a08a-ca5b64505ae7
 14 89703387-8e4d-7174-a2dc-9645fb6d30c3
 15 d9cda86c-abb5-6851-9eb5-0e7af88e88a8
 16 493709db-63cf-673a-bbef-6e72c99f94c9
 17 c7cc9600-7e22-7b34-b293-d112bcda1243
 18 3d97fdef-5123-67b1-bfc6-ba7d38e01da2
 19 29e52cc6-096c-4d0c-b1cc-2ae244c544e0
 20 6aa61ed0-8253-1d10-b963-06b9c55cd54f
 21 ff538da9-1033-2d67-9b11-b8736a5b32f2
 22 77031a20-2fa9-3fe9-af39-4e8daada08ef
 23 425653f1-a9dc-1a8d-a134-43c883412eaf
 24 f91efb73-695d-75b4-8cd8-874a970fbdda
 25 06893ae8-1059-6f91-8c26-dfcbdba95660
 26 ba1af9fc-b987-1527-9d1d-97cd75106948
 27 26b4b212-b377-84e5-b215-767c0770d18e
 28 ad8e41ae-25b8-2af9-9021-bd2a13c74399
 29 2d38071e-8ad2-5ab3-ab8d-371552a08fe2
 30 1c2c1fa5-94a0-388c-bb0f-77c4f79ebbc5
 31 7321e83c-ed07-1d84-b697-5d08b37aa8a9
 32 53863ad2-a83f-7a43-b7b0-734823d6bd00
 33 7efd1c78-db5f-388a-84c5-1fb662230d9f
 34 7e96a0e7-b237-322f-983e-2496c38b887c
 35 1ada3ce6-b9cc-371f-ae60-c81815c722a1
 36 f3992ad6-64e6-0a22-8fbc-c63ec858d221
 37 caac305a-14c6-245f-b3ab-cd738e644757
 38 f6cb7599-bc9b-193e-9883-d0ba2508fa64

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 45327577418467667641231761825317333021. Exactly this sequence comes out of new Random(214).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 32 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs