A858DE45F56D9BC9 archive

201212061000 14cxpx

explained decrypted filler

seed 51

Metadata

Post ID
14cxpx
Title
201212061000 → 2012-12-06 10:00 on A858's clock
Posted (UTC)
2012-12-06 02:00:11
Timezone
UTC+8 · title 10:00 against posted 02:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212061000) = a9845cc5101ff7b0a506079485fb46ce (name+title)
GUIDs
24
Filler GUID seed
new Random(51).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
63 · predicted N = 24 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A37E114DDE958916 72BC8CA6A33D11F9 8D3F8E539577C37F E0CAC19EB1DA184B B9F6970773C8D751 6CDA5A528DFF1B52 1633F3622806757A F0580E7976AF5AC3 E66D639B36FC0426 3B28D95F7C532BB6 ED8EFCCF64930A2A 7819EC1EB54C295D 734CE31301A70F3E A19DABF1C11980D0 C690F252E4BCB126 A0A104B9E4656615 A42A5801F0556491 3992ECE2583F70C4 67D30BC410E4028A 39556D0CDE007377 5ED92B7ECEFE7CFE D92C8219877C8F7A 458E2BFDCDDCBFA6 73D7DC281AF1B887 FB5CD9736B7CB0D4 9C50CA1CEDD9047B 9DDF2F5DED1E7E92 F5127ABF94D8E929 4F72FE7BF4AA6EA4 377A431339737CBF B422FF6F9362A8A6 3366F6EE50152A0A 6401DAFFD408A0FA FA42774DC431CE8E 6A721B6D28BE0D1F E60E2915D89E6E91 B08EA0477DD3F4F0 D94C18196DF0C685 A509002B8F8335AD 34A50FEA71C26241 CEBD1660B04EDE8D 17CC6081B60FCBC6 A389893F08F0DD54 AA25E7E8E2F2D2F2 921FA835608A42B9 371C7EA6218282E5 6CD40B193ED00139 07CA2AD8AA026379 91ECCA6C37DE87E0 327B4EAAC42D3418 549D7388A08488EF 5D773FF5F639A749 46077AF7FC09CC5F C5191196FD28902E 53A30FDE6F6C959D C4784F39F3E4E4F0 56797BD45FE62FF9 3FD8A2DCBD44F6BE F8B7CEE19D98DB4B C17B5138C3880F20 9D84F81DC96160EF E53D83221086DD8D 3C6B2BE2B2661B02 FB5C524152633C15 E6898F3BDC985855 368772B8C0B5561D 6BFDE7A49146744E D3BFBE694EDD5A95 26DCDE0096E8AC8D 75472C7279E5CFAD D093ADC59F29B0FF 00D74452C4B75A30 801C2F54200E628E 221865D5B85A7D49 5FA6EE27FCA8946D E6A156A595F3C9B5 5F88570B691F1009 176EDB0369287E27 5D9421E4D7D4775E F04D536134DFA5A4 693DBC60B05BF6BD 313168CB0626BDC5 C0024CFF9E4D1BF9 A61984CDF1D289AB 2F1153CBA26F01D6 7420BE7FE8118A5E 253BE59B54575CF4 E082F4B369A9C92E 68B79175C7EE7802 8206F5D792632534 D68D20428A50AB37 B578C7D8874A6F07 B7F9CD30C3AFD870 8E99280F55813D7C 7DD536D492FBAE2C 57CB9E692344EE3E 022B3A1F178EFD9A
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212061000 (name+title). Key = MD5(password) = a9845cc5101ff7b0a506079485fb46ce, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8dd3b780-6403-3910-8704-d76541e64722
  2 0dabdfc4-575c-7159-aef7-1d692336763d
  3 97afba50-bd2a-3b9d-8613-f437224bf6dd
  4 035bf04a-1839-370b-8976-a600207b2d37
  5 b8dd95d2-d09e-26ef-89b1-7ce0f75cbf6f
  6 90cc7f4a-4649-1917-8e04-a1de6227959f
  7 d518c37c-a0fc-669f-a565-498c19e3410c
  8 66050d53-ebeb-0e49-a1e1-0e3ca9466a94
  9 7c62d748-32f8-2696-95d4-dfaa60cfe436
 10 56942634-d8a3-036a-a30e-3ff4d7d63b94
 11 2995a83a-3e95-7cf0-a472-49fd89b570df
 12 502c8691-dbcb-2f78-9124-e647ae3dc2c1
 13 8216adcf-b8f6-60cb-9615-5c6dec2db960
 14 dfc1effb-d5d6-0d95-89db-f74ddb29620e
 15 a00e95a2-4c4d-63df-a5ca-54dd0f5db2ef
 16 1fc714e0-a9d1-7da6-9a31-d76ffe1c9963
 17 5e38756d-01ad-2a5f-bda2-19f55c2f6750
 18 6f16449d-e2a1-52d4-b1d5-8224698bb47e
 19 56c2fcd6-f055-016a-a0c7-c47d844eb5d6
 20 23523092-c045-089b-bbdf-349df941e041
 21 f354f14d-b7f9-52b1-b25d-d3dd960a9db4
 22 b7fa472b-8b00-343b-b766-b663b3aa4ca8
 23 3a676ab9-0916-5f83-a131-1000c2fec29d
 24 fa5144da-4c4a-7dbc-9764-2e1d5c6c57fa

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 373321602072606725005357. Exactly this sequence comes out of new Random(51).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 63 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs