A858DE45F56D9BC9 archive

201212060800 14cplt

explained decrypted filler

seed 369

Metadata

Post ID
14cplt
Title
201212060800 → 2012-12-06 08:00 on A858's clock
Posted (UTC)
2012-12-06 00:00:09
Timezone
UTC+8 · title 08:00 against posted 00:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,000 hex characters · 1,000 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212060800) = a6b47609b1836d9e7f532352cc6fcb5f (name+title)
GUIDs
31
Filler GUID seed
new Random(369).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
62 · predicted N = 31 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 3
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

4DE3B6AEE0190F04 015C5932373AA3EB 3BDFC8D9CF98755A 8093764EE2F5D75B 390F34B4256CCB9A ABB3FC3F1656178A 5CB94BB8878E1F43 0AB828B26133BC1F 7179E3791CADEAE6 CA567C10D380EA21 9A47E8003B4A08F6 81E90E0BCA28790D DC87E34BEAB80C3E 28A0019BC91A163B A5D5D3B986DFE5D3 334C2D87800B88F8 F9A6D4D83949CABA DD94051544BA2760 7637D526B4FEC793 0DC752C813034170 AE52D44DAFBCF0D5 77B71DF0BE79357E 75E404DF8B4F5361 53440B10A68B443C 8CD4888132C5CD9B 6D78127B077BD6C5 AF3FD9CA3E764A1D 479782E5DC6457A4 A47E3AD85A47938D FBAEAC64ECF778B1 FA77C956F3C3C362 FC11C8AA83923BF3 A02A0836FD6F39F2 6EADC2C66328D7E4 F1CA3967469AEDB3 EA07AD91E73CC25F CFBBEA2EBF302668 FAD5EBB98FB174AF 15AAA4F4B4643B64 E975B859F841FBDC 50003E789BD049C4 44D349BED583867A 49F5ADCC4A22D1CD 9289703412135F61 033B353BF984A69E 955D45E273DC2881 F9E2FDD548A92174 8421AEED620DF305 4A2097C40ABCC14C 209343F6F9B59A62 D8A6F5230651523B 83550F02E2ABEE15 6E2D1FCDB86C9DED 57C4B6B0329FEBE0 F533F11E571F8C8E BED5098C86C0F041 006809468C1F236F 8C50EFA8A2BD756B BDA4DFFA1BA2070C 8C159C0619CE353B C649D7D9EC593908 306A20C0558CDCE0 ABC4DB34FB165A4A 9F2989D6566DD57E A71655DA9965B36E F3E66E65B5416305 6B168CAAFA802DE5 73D74C33E2C3395B 15F9155BDEA07C04 5BCD41AE89F92974 CBB7ED8D68AD7837 F4CE7C6F8B9CD357 A1D738877180B8B7 B89D3BC754BAAD39 1BFE6E9B2D7CCA22 D72A2E173D822897 3E18C2A935B4B8AD FA16B7B0AA0931B2 C4F6FECEECA9E56E 253ACC11965DDF6D 85BAA06AFCA24892 405F6D43E1A21614 DADC46CB550E98A1 3EEE9B52013C9DAE ECBCBF8D09BEA3FF DA9ADA637893A704 7DFDC75373D17370 7F79D226B82ACDCE 9D2459004E5CF82F 772D271BE6581416 6D9E6E271E2AEDEC B9C76144F1208E60 855A3B195126A7D7 11FC55CD71E5CD8A 18510A666E8785BB 5062EE103EFB4143 1D391614F3679376 41D70DCF4BD2FA90 718A8B4FAAA18CE8 908FAFC700DD6AB8 42EAF2B2FAE1561D BFBCCFF13CB8413F 38D8C871A530B09C C5C353E20E668EDE 155AF6D5E52FA898 419DA4C6B1C3E3A9 D73C13E99AE839BD 07CCB08BC40992A4 097718231FD89B42 7BA3AE863B6430B1 7AAC7BDD2C5AA4CB C36AA6F7AA803B75 F19EC5124E41136E 50CB7F2FE3AA6985 050C2F790B63F293 FC73913B4BC32D4B 9C30ADCA943BCA47 DD05A42A0177AB5C C917A67B911BE3B1 A324D5CEAD9DFCF2 0B46B84A2077A1E6 98497960F72C49B2 0EA61BA7D27CE9EB 7D681211DDCB906C CA0335E391F2AAED
  • Read the ciphertext. Strip whitespace: 2,000 hex characters = 1,000 bytes = 125 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212060800 (name+title). Key = MD5(password) = a6b47609b1836d9e7f532352cc6fcb5f, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 31 GUIDs as hex (shown below).

Decrypted: GUID list

  1 613344f8-155c-46c6-8672-135856c8bcdf
  2 89fca3cc-a25d-0584-b42d-3b3e1ca5b9ba
  3 ad6a34c6-ad09-6bae-8b26-1ed44b0e567f
  4 1766b0e5-0731-20cd-bb13-992530b4aee9
  5 fb49c2aa-eab6-7db9-968c-6408b438b9f9
  6 4172ef8f-0d1f-0f7c-af80-c7c6d0cbbbb8
  7 fb6777f4-6479-254e-91a6-125e84a015bc
  8 ae0efc8f-5793-5efe-9938-ef2517a1d413
  9 0410937b-dc9e-5228-bafa-7402ede369ec
 10 95187ebf-98ce-3f29-b7fe-6aaa1da54058
 11 9889743a-2e24-1ef0-8328-c85722d356fe
 12 a6643bde-4750-4464-aaf1-0795cfdbad96
 13 eb12224b-3462-28b6-b9f9-b0d5ceeef7f4
 14 ad39d138-1228-3f1a-bbb3-0742f7ffcfc2
 15 45dbca03-2056-267c-818b-bfd4cd9956cc
 16 63ef29a4-e0cc-4d20-9027-74c2f765a37b
 17 9f84fd82-8e90-896f-963d-42d0d0cc3efc
 18 da30910f-d4f4-6547-9868-0d7427b1ff22
 19 88df8b0f-1945-5b28-8af7-07e1beb1516a
 20 7561deb6-c198-1208-91ac-0e860ef8eb79
 21 f5137e18-b1b7-7f29-856b-6da50f4b5f50
 22 4310761b-1f78-3207-95a9-2e4b9bcc9721
 23 1541197f-f61c-304e-9ef6-fdba1062169f
 24 30672cd7-7a92-8048-8a7f-26cbf135ea60
 25 54a9983c-ff5a-7214-b650-781e82e8e340
 26 a986cad9-f038-7d5b-a58f-bb922c65606a
 27 4656853b-3418-1bd9-b14a-f3cb23e3c307
 28 a99501ca-988e-2f61-886d-61482093335d
 29 4a364db3-6bd6-43b3-bca3-da80cacaa5fd
 30 212f3d7f-3da1-2deb-b408-a51e59e9d020
 31 737ebb77-d2c3-35fe-aae0-f45ac3a84992

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4062702553142324865173387712423. Exactly this sequence comes out of new Random(369).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 62 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 31; the post has N = 31 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs