A858DE45F56D9BC9 archive

201107041325 igmjv

best-guess decrypted manual

A masked GUID list: 8 GUIDs, seed 369. 3DES, key MD5(name). Open: the seed is tentative (only 8 digits).

Metadata

Post ID
igmjv
Title
201107041325 → 2011-07-04 13:25 on A858's clock
Posted (UTC)
2011-07-04 20:16:18
Timezone
UTC−7 · title 13:25 against posted 20:16 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F2 filler: masked GUID list, seed 369 (tentative)
Size
512 hex characters · 256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here
Its decrypted GUIDs are masked, not genuine v4. The sidebar held all eight in July 2011, and its first GUID's missing start is the sidebar's own value; best-guess mask seed 369. (new results)
GUIDs
8
Filler GUID seed
new Random(369).Next(9) best guess
Best guess: only 8 mask digits, so a chance fit among 1,000 seeds is about 1 in 43,000
Run
Before the scheduler (pre-automation)
Draw
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
115 · 58
Tags
pre-automation2011Encrypted masked GUID listmanualkey: namerun: pre-automationfound by this project

From the post to its content

As posted (encrypted)

E00CF0D1F17422DA 5508FC0FA6572277 998F5A617A0F2123 4ACE9CC52994E06E FF04520983FE7FA8 DA70EEA20742B7ED C53E5FF192D79E26 DF5E3EE52E90A42F C7330915A12C352B 89B3037DCA4A23E2 65D772F4DB20CD44 760D9CADD267CA48 BCF5D0AB83A5AAAD 4F24FCF757612602 B8ED76EAE7370A5C 70AD027EFEBCFB3B 54B37AEC7B4EA9E2 581494E8ED2A0BD9 A713240063510A93 FECD85F9F11A558C 8C931A700DCBCA7D B0FC2A4BC1838C1D FBCB1377106F9BF3 6B8DC3DCB3F1797C C7324D654CE0AA73 4238400B11AC91D3 708A5D199ACD6056 7174F92A186CB754 7DCF4E205412849B B098F5C522751732 E68D2215D88B2E11 C9CC09E299FA4B14
  • Decrypt. Key: MD5(name) = 34A14A42E98FF96095AF56604E290CAE, 3DES-ECB. The plaintext is 8 GUIDs as hex.

Decrypted: GUID list

  1 529bf170-a7ea-486c-a4ec-48bcc59b05fa
  2 2e8206ba-a90b-0740-8bf9-cb00940fc116
  3 772cff4f-f49e-6512-93ac-af1aa6ad29da
  4 81874caa-8b99-22fb-847a-aa516703e0cb
  5 45c81bf2-96d3-78ed-997f-1f6b70b9a72c
  6 68ccbd64-5f2b-0205-b555-dbe6550ca1ab
  7 e207a5eb-8d6e-2333-853a-cc46158dd442
  8 174aebae-a7e5-5295-b7b6-ba83e3cefcbe

Explanation

  1. Recover the first GUID. The decrypted text starts 8 characters into the first GUID. The sidebar value 529bf170a7ea486ca4ec48bcc59b05fa ends with the characters the post keeps, so its start is the missing part. The sidebar showed it from 5 Jul 2011 12:38 to 5 Jul 2011 20:55 (7 captures); see the sidebar findings.
  2. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 40627025. Exactly this sequence comes out of new Random(369).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  3. Best guess. With only 8 GUIDs there are only 8 mask digits, and some seed from 0 to 999 would fit them by chance about 1 time in 43,000. No other seed fits, but a longer list would be needed to confirm this one.
  4. Explain the count. Grouped in Before the scheduler: before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit
  5. Conclusion. Filler: an ordinary masked GUID list, with a best-guess seed.

Solution summary

Method
3DES-ECB, key MD5(name); masked GUID list
Result
8 masked GUIDs, seed 369 (tentative); first GUID complete via the 2011-07-06 sidebar
Explanation
Encrypted, not plain. The archived body decrypts in full under ECB with valid padding, but its text starts 8 characters into the first GUID; those 8 characters (529bf170) are recovered from the 2011-07-06 05:38 sidebar snapshot (c23vtyr), whose fourth entry ends with the GUID's 24 surviving characters. Seven of the eight GUIDs also appear in that sidebar (its eighth slot is the name). Tentative: version digits 4,0,6,2,7,0,2,5 fit Random(369).Next(9) at offset 0; only 8 digits (chance about 2e-5). Corrects, which called it genuine v4

Related

Findings: Mask digit · Count RNG & runs · New results