A858DE45F56D9BC9 archive

201212060200 14bzmc

explained decrypted filler

seed 1

Metadata

Post ID
14bzmc
Title
201212060200 → 2012-12-06 02:00 on A858's clock
Posted (UTC)
2012-12-05 18:00:06
Timezone
UTC+8 · title 02:00 against posted 18:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,680 hex characters · 840 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212060200) = 18d4bd3055d03a2138410e1f851611a4 (name+title)
GUIDs
26
Filler GUID seed
new Random(1).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
59 · predicted N = 26 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

169A98260F40A5C7 E265E9007BF4CFB6 DF88D67E17849875 4E9D5DA3A4B06C4C 70F648E3F2ABE373 53F1E8FDDE1645DE 4362B302271FF183 82A24170B8999C69 B50B41EF8A660DDC B46B59208C6F76A7 926685DE3A979201 62B56BB692201B9A 505D5C8C915F0E33 23CD546D6D6ACFCB 6E7D4CE832FEC72B 3F1B2976C0470C93 F282C5CD7FB7D988 405892ABAAA13693 8CFE7C355CD8BD13 85F314BEBA9767F3 47DC7D2A2DFA442E 3DC64DE0B49FBD92 E21623E022390B94 09C8E34C69D9D444 ED0398FEFC65534B A4AA166BCB90A8F6 D4032A29EF710AA5 86D7F35CCAF7CCF1 562AC24CDB87D90D BF5F772D518C07C4 930A530853CE87D9 EF1FD0FD533FFBC0 C7C2EFD1FAF42E48 04C5C3D5B20AD1B4 8DD8975F860DACD3 9245CA0BE14EAA61 15BFF363DFB19641 8ADD1C8C8FCE0491 C98393E39BC1B387 9F49E6B72BDBE21D AE8F6DCC15A292B8 A39CC8EBCC7DE225 7E95690160027A42 A35FFE5F978E4380 AA6873E5F4B742C6 ACC0FD1033BA5B4F 2204E75B12940F6E 67D13E070BAEB03D 9C66271C281D4FD6 9AEBEBC169D5AC31 FD85B03D0C7B8B6A 1809B3FBC9BDD32F A77AD5B939FA6560 B47C821A80FCB69E 492509EFD4ACA4F7 F6DB781FF657C178 13916D5F6DB1AD52 2C3398FDFCD64085 E3B2E591EF720D88 59BB1FABF57D6594 90CF136C035AAAA9 4ED86EF641FAFE28 795B2BBC873C8B33 14FE1CAA7BF6E663 141927F5374071B4 F46790DC82058779 B4402AFAE638EE48 4EEE6EEAF4E3AB25 D7AB443170ACB2F3 B3CD64B0F26CB1A6 A1EBA34E90BC9B2D 66E49D3F09FD5373 783F57E5535A2B8A 7E2BF19A7977BDE1 844FD55D85715775 76B6540485BA3597 74A89AEE581A2B5F D38B3F4F60D305D8 AA9826CDEDCF9861 5481C97F1C5041B9 7CAB6D4915FBC6ED E7B1A5B8BCF9CE87 BDD119596863D69B 04A8DCB33368F4D0 B898D8399F400598 C197D9014946467D E91BED23375BA0B1 1B948D5493083B33 BAB6F7C07F9088E3 5991E178375627D6 7617C9F17D9B6362 46BB445BE964A24F FFC31F61400C7E46 1D148E4BF438B706 9231778912A4C52C F7B538C4690EDA28 C993AF8F8853AD50 4FD20F0873504867 29ADDA0F7EA7D277 5362B67F509A86DF D19F56A78E889A38 C34B2670BB42BC01 42CD8BC2DB92BF3A F48DA0939FAD3F84 1BAEC3642DF3ACD4
  • Read the ciphertext. Strip whitespace: 1,680 hex characters = 840 bytes = 105 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212060200 (name+title). Key = MD5(password) = 18d4bd3055d03a2138410e1f851611a4, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 26 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8a01598c-aac6-238a-ab66-ef770fa7de1f
  2 9d109a3e-eb55-0f9f-ba8a-e748f1ffd157
  3 6719ea99-1364-417e-b215-b29c6470afbc
  4 73da6250-c96e-6a96-8169-fc134227f68d
  5 2fc4422e-9687-5b26-9aac-667ebe0dd07f
  6 cdb85cf4-9a85-3d15-9e50-8dfa65d0ad4e
  7 02b3618c-e077-3a1b-a156-589eefdfbe97
  8 d37c30a5-6081-8e5b-a04e-1d27fd296b48
  9 19974ced-3538-0710-af95-a48871607d8e
 10 b7c70bfe-3d4e-55db-9849-e38369df87cd
 11 7b441821-0441-0164-80a0-ab9032ea6129
 12 87b5e70f-449a-28fa-aa56-7fbe0cfaa918
 13 1c042f07-4f62-2c4e-86d3-d13b8742d965
 14 7e42b424-5dc4-8952-81e3-84cc3bdfeff7
 15 65f0e25b-dd3a-66c7-9db3-73dd502271f7
 16 681826b0-4519-5b08-9037-cf06462de469
 17 e1a76d01-1c52-2a1f-9139-90a5a9e2e145
 18 3f3024f6-f80e-58f7-b530-9cfb04a403dc
 19 a41abd6d-f176-6528-bf04-daf744b7daf4
 20 6fa65bb2-e958-691c-a6a4-e77915392eba
 21 f1b2162d-4803-8a7c-aa62-fe005d611bfe
 22 e288a151-d4ee-086f-ba18-d0a5e8379890
 23 c2829afb-f26b-1d87-8cf0-503da6218380
 24 a9d5352f-de15-3439-bbf7-a7fefb65712c
 25 799e3f37-68e1-70c9-8b33-1f0f259fa40d
 26 0774320d-aef9-1f62-874c-6df8d59df0a1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 20465338050228652566801371. Exactly this sequence comes out of new Random(1).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 59 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 26; the post has N = 26 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs