A858DE45F56D9BC9 archive

201206260827 vmsaq

explained decrypted filler

3DES(name) ECB, 23 GUIDs, seed 345

Metadata

Post ID
vmsaq
Title
201206260827 → 2012-06-26 08:27 on A858's clock
Posted (UTC)
2012-06-26 15:25:47
Timezone
UTC−7 · title 08:27 against posted 15:25 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
23
Filler GUID seed
new Random(345).Next(9) ✓ verified
Run
Run 1 (seed 1,054,668,128) (seed)
Draw
1 · predicted N = 23 ✓
Machine boot
2012-06-14 10:27–10:27 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

40ED08668444B539 162FC55976032FDA 6BE3EECBE992A2E4 10E380802326F116 3A72AAB8511FCD09 CAC92873F501F062 57D389B022684D97 845F9AB3DA16A69B 86D2260D33EC5231 16FF784078CC1ADE C5CC3F0C37B01E58 98E1948AD1376E3B BAD2CA324BBE105B 8B23D28427B707DF A9880AC43B26C961 C4812D5AA580F14D C42FC766A167BCBD CEB5598416BA9FAA 58E8D70FA2C5DE52 C1BE78B36A92D798 19E43098C433BE63 ABA1BB021E388F6D 9923797D1F0E6DF8 42C9A4C15BDCE99F 974A6B0CB8CD5DE1 16C8BFCCD13375A6 BB25AC3DE07B9F9B B5AA6C1A0CBBAB49 BD1E5B801C55CC90 98B1F18FE9DB6F4C 742E544FBC23D21A B4BF9F34B721FAE8 FB87344602FC31AE 0939DF5DE519713D DDF0D9A1032E0FA0 F8680D3873A01EAD C6B27A7A6AFB2713 8E25DAB172BC45DB D6661DEEBAD9E9E7 89A2D4C6751A373A C4DA7BD81D5C8022 3E0908F02A737DBC 5660B8FEFFD67D2B 7FF596A3AD37231D 7DBE678DA5686177 04DCB5904A9EC2C1 730CEC5B9819F88A 153D25CAEBCF5FE8 8C33C70FD74B8950 DB36E9A76C04E54A 912C2258A8F4773A CAD91A3A08C89874 16ED57C8B41FDDFD 8C54BAAE9A851C0F 7A964C7399382CD1 6460CF746454E174 D2AB3E0CC32392DB B418EC95469C6045 A5DCD69BF7ED175D 7BC9660BC0DA288A FCFC756D9DDF4F22 E2DA8FFBC42F11E4 C55282A5580D28BD 1BDEBF820C7E3860 FDC4AD21FA837D7B E94E127865E2D9A3 BAB545B0A888CD6D 94B8D7210570BEAB 1CEBC107F96D139A 1273AAD48971AD5F C6117A194D6564AB 44C79F578AF3F92A C678E60664A34BFE 7F5252DB6FD66F2F 00C12F9F839F3043 19A79E65C6CE51D7 0A402DA51EB1DC2B 817597144B5F6222 448A54FA1E249A77 54A82D4F246A4AFE 96E78DC9BB8DF245 71D270E2A88ED50A C024D2B569008C2A FA057951237BC5E3 B22423F026809A0D E71D95BEA6A81441 3E91395F39BCE889 3CF68300F20DB691 3A28E0402925F11E 84FACF84B4C09575 D7E1B1DB43938FB3 8A5A18D7C673FE01 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0781d204-4a05-8893-aec8-d7ee03d3085b
  2 6fb56d06-4ccf-04ce-9547-01305388641a
  3 338bc5c1-8644-8839-8639-1fbe772c8b04
  4 6584fbcf-7009-1f11-a9c0-84d0402f48cb
  5 97135b2a-fbdc-8486-b132-5508db42d4b5
  6 f7eb634f-b57c-0270-86a3-af867f1bab53
  7 3ff84db6-afb7-478a-8b30-8bd50d09ee3f
  8 22aab865-be79-4a74-b952-4ba534a589a7
  9 4b6c0f24-f51f-5310-a15a-559d2ca1880b
 10 5bfeac03-6810-4389-a66b-886a7298a8c5
 11 e170cbc1-27bf-46f6-96d4-bbd98932d9ca
 12 492f4579-af58-7b4c-a8bd-49e79c79feb0
 13 7783f5d7-5dfd-7c9f-a293-fb632cc56c66
 14 e985db94-661d-8029-97a0-669035e16d8b
 15 a2c53e85-6b6c-4dbc-a94e-07f96bf86b90
 16 db80e4a3-d5e4-41f1-b7ee-93922ac37775
 17 00c6ccc7-b810-7774-90d2-0e97e2a19015
 18 ea6cf6ec-206b-83fd-9a3b-184d7c61e47d
 19 549f6a20-eea1-0814-84e0-5e5af5832d55
 20 43ad3fa5-d3f5-8515-93c1-108b192f7db7
 21 a25a86f6-8124-51f7-a1ac-7aceb2f5ad0e
 22 3d0fee09-c61f-470d-b3a0-796a6bcc4178
 23 a22e4358-a697-2247-8a51-4834f88a78ff

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 80818044544778447808542. Exactly this sequence comes out of new Random(345).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 1 (seed 1,054,668,128): new Random(1054668128), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:27–10:27).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results