A858DE45F56D9BC9 archive

201212071200 14fc5c

explained decrypted filler

seed 539

Metadata

Post ID
14fc5c
Title
201212071200 → 2012-12-07 12:00 on A858's clock
Posted (UTC)
2012-12-07 04:00:24
Timezone
UTC+8 · title 12:00 against posted 04:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201212071200) = 55a1da9410eb9113f0ce4a0c3952da1e (name+title)
GUIDs
38
Filler GUID seed
new Random(539).Next(9) ✓ verified
Run
Run 39 (seed 1,106,402,812) (seed)
Draw
76 · predicted N = 38 ✓
Machine boot
2012-11-20 22:02–00:02 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

AA31814EEAC79419 EE602FCDF4741F21 02700F8C2727A8D1 E1A5621DA50C59A3 63C0AF32B0F13DCD F11590E4EAD30F0E 1A4E98A503BB2F64 AAD68254556BCF90 017DE29214952D65 F1E43354EB377B11 9931A244C870D9AF 07CE60ADC6360132 D53A7EE6411190E0 909A9AD8F2365A98 7382E478B52F411A 05688F53A39BDB0D 0BDD6A8C0A79AE75 59864124ECAAE777 9AADDA894289F259 897CA2DC86106074 DDC1D4D36B3AB857 D2D5EBB0BBE01DD9 9051100D0316A1FA 4FF90F7969B674BF F3B56FE04FB29405 BE2D254B03298123 51DBDC2B6189CE01 234E52AC22278019 3DB6DE7A7CEB106D EE4725FB1160A1B8 DFAE32B399DFB8DB B39C4FAACDCE78A7 978409D137A5F425 4B78ABA219AB8D64 06BB7D586FE2D7D9 26B72D17477CFF5F 719A8DC3A9E17A13 D3485B541A7DB26A 353FF1B38319CA19 C853C3C0ADFA1175 A3EF4CB057197A52 B84172DF8F5C919A D5CAAA246694A917 D207B3A08541DC87 CCD1E55BAC2DDC9D E8C2F992EA3FA6EA 4D6468246FCDB6D8 5801BA368F19AA92 F232C7C909A7E707 985719029F085854 D5D36AB2951FC66F C9E39B0E262423DA 50A78F13F5B2FE00 7AB9F1B2407F5810 FC5FEAE6381F81FF 4E2CDC931FD4F8FB 378AA9B64B7C4F20 0D0621AE2BBF58F4 7D9D28B23741E3E2 36C3EEE72017F4A7 1C137AB0A6641146 285303286FE2B333 86093A4EEC7345F1 E2732E535B38307E 695C6A9FE8D3F60F 0AB83E14CBDD61C9 5B1FBB3C19533BCD C0D967DF62D826B8 EB55DA5A75B477EC F77C2427E78540E2 E1CF6E3D728EBAA7 44B9000F1381F62C 9E7F0B57F3D35CFC A5CE067C987AA218 4B19382DF74AB77F E1D9951ABF26C7EF F0918BC1D9A927E4 3B0413E36A6AA7BE BD2393E1C92C7D55 085970AC84EAF8A4 51F4A7E91CE0D3AB 91D6E17EF4DDBA8A 4A16F73862C485DB 13385CBB99CDEC6E 33373FB9181BFC72 1093C4C54A43E755 C73CCD02900906EC B9335FE50CB36E46 B81B8E6AD58C2EB5 592E55F462D70289 6B66EAB7A362336F D447EABA74E4BB3D 1AEFD4B39975F7B8 7FBCE19AE6BE727C 9F944F6D2116136A 9D632F30C8B14759 6C29F3559887A0AC E29FEF1D548BB1CD 8EA8334FADDC6F54 23DBB25AC1947FE3 74C49EFAB98C6DF2 E982153B4AE1639A DEDA292B9390D65F 28AEA127E38D9CC0 CAC48B9AAB422BDD 8B2F430D0BA30C49 0AD3B1AE0DA24FC7 795F4BC67E89400F B5A4150EC3F0CA2A 5BA6B51A3E35CF73 4877FE831C05383A 704D5E46324EBAB0 106452A3806A00A9 AB2DDE21F2BA4828 3D88C1E78A33674F 77BC3708A13DEDD2 D66E7A9902A7E965 D095FFA78792F80F 7C93B75C36510824 9D686492323E7D3F BB5E27A7FE1EDF64 EB5CC647B569EF98 9D9A44D63E43D8AD 2EAADDF640E101A2 D2FCC61CA0AE7E21 AFE8381AA3197EEA 79A90A981FF11F30 B31346C33804F0C4 DCAC84E226EFD8B2 9A87B00B6A96AFC7 62ACF42A38DCF752 62594187C99B41BA 2CBEBC5D3CE545C2 B8E48120005EF0E8 D97A5A72CD78C562 5B218D637933695F 76498326FE9018C6 46C0AA62F4ACD722 5584978CE270969A 5F031AFE91398991 80BBE903A0CAC8FC F7F65F847CC8B7D1 C80F061A9CA50E69 1704931CD99BB09D 35D6B3C3DCE14CCC AC8F3FA2E29FC79A 113BC066DD548C09 11301DE165A9970A 41C6B414BFA5C7B1 DEAA8F25E88A3E4E 42DA48AD52BE2EE0 EE3FF392C58C1610 8556FCC3A1B00534
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201212071200 (name+title). Key = MD5(password) = 55a1da9410eb9113f0ce4a0c3952da1e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e94e0cd5-ca37-22e5-a11e-5afcb55105fd
  2 144e8bd2-4d0f-8ee7-90b5-cc65bb425a38
  3 f775ef0d-e54e-4353-94bf-c0aa1184f841
  4 627ffe07-a156-5867-b4e2-199912cb5faf
  5 bd3c760f-96fe-5b38-8a0c-ff269cb34788
  6 715d5f13-9cd9-5a8e-aea9-7fc160fafd5b
  7 bad34970-4d9d-379d-a655-122b512b32c6
  8 717164ab-5ea7-736d-837f-028c1c6325e9
  9 ea941aeb-70e0-5642-b3d4-e32b169a0517
 10 86aa0f17-8104-0020-9acc-34ba15eb36a0
 11 b9265d3e-2a0a-369d-887a-7838eda1fc07
 12 69529c78-3942-2c42-b06a-5e0ba693d81f
 13 bd1ba2f6-1820-10f4-be3d-2465ee790c09
 14 7fda06e2-cfc2-707b-b101-11190cb5e43c
 15 ca323c26-b1d9-2ab2-bf8f-c6dfceac1d67
 16 af5ccfb4-ad1a-5415-8a98-b2f7c36bab47
 17 0e854b7b-6746-3ff5-8fd5-1763256be701
 18 f7442d99-a7cb-1ae9-8d76-b7c7e436a074
 19 b502b348-d4b9-2b1f-a9b7-667a4e527e9a
 20 a50d9550-a943-0e95-9686-031b1419c679
 21 91d196ec-9d26-3b12-9846-92ed8bc538d6
 22 7142fbb7-7dc9-0a9e-b837-b47e983796b6
 23 d701b98b-2033-02fd-b644-bcc267cbad61
 24 7e2db7e6-888b-2c7a-abef-c113e0f14556
 25 7f66a4a7-7707-49ed-9dec-078da3892358
 26 4773dcf0-56c5-1c1e-8358-92adfe6a7d26
 27 589a9884-7d18-387a-a914-b66c7e358e22
 28 141486cf-322d-5a42-bea1-6798d62c4c29
 29 e0bd2b8e-abbd-3c8e-b1f8-430361b568c3
 30 98d05299-8ece-14cd-aca4-b6ab431f7488
 31 b175532d-79b9-165e-86e3-08e28df2d15d
 32 886b9f60-1b45-394b-89a2-6d40c3c628f6
 33 b26e94c8-0ff9-08d9-a17a-3768321f22b6
 34 d24cfc44-d057-4b81-8ac8-2398899b416c
 35 3916d2c0-6007-7347-904d-533ecb0981d3
 36 0b2b80dd-b864-16d6-b728-a0f13951d584
 37 c892c6c4-7f39-4db2-95e7-d72f7fa5330b
 38 92a824b3-71b5-620a-b4f1-b77918698bb1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 28455537503217253120300241353113047146. Exactly this sequence comes out of new Random(539).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 76 of Run 39 (seed 1,106,402,812): new Random(1106402812), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-11-20 22:02–00:02).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs