A858DE45F56D9BC9 archive

201206261047 vn0vi

explained decrypted filler

seed 154

Metadata

Post ID
vn0vi
Title
201206261047 → 2012-06-26 10:47 on A858's clock
Posted (UTC)
2012-06-26 17:45:54
Timezone
UTC−7 · title 10:47 against posted 17:45 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,424 hex characters · 712 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
22
Filler GUID seed
new Random(154).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
0 · predicted N = 22 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

22C970DC4B633A1B ED10AD9AC7684F6E F007A1858B930844 FF9E68F9D605C4EC 5E31765C778032AD 75E0C776779EA8F2 0A5FE5CB0F0C5F7D 7338107B93FD184E EDD2B0DD73AC9D75 0297515AEBF1C8F4 579F93443A59B4EE F6E320DBF9F7B42D 56D17784DA493E7D 674310428FC8D093 A7974C8E9AAF7321 E1E9E15F7B87C008 21357214C0878638 433A5858E8045F80 45621DFB9FBC2D6D A448DF38629D012A 4DD7EE38A9099378 B5129C46F5AEF4DC 9C85CBC45B1F57E2 298996F43223FA6C 021A24CEE5FA3DC9 050537D06C8C4D2A 0579813376B35921 8F17F0E39844F44E 93EAA79701936880 BEF27ED6BD77B45C 8820C54FF4AD2878 4204EBD9DBDFC1F3 D6DFFFE4BAEF0774 226D50B56027D2EC 633E44078A5DC45F 64EDCB15EB134044 B5507368A3C2DDF0 6C9ABD1ECACC317D BEACEF403E6FCC4E 7327A690E3935763 7ED6F93BB16D769B 8E978865543C2DCF 6B6BA22FE285C7F1 838D1AD2DF4991E0 C7957FB643AE0E7E 3AA48D5913EE35DB D236E8491EA38D85 3FEDE41C2F1B04EE C60DE75EB308942B 23CC7BBE8FCEC076 8D3B3D2503152F55 8B423457A46146BB 4B6BBAE48ABE40A1 0C2A58F7C0441854 AF63DBFAEB4EDE1F 40F376CC6CCD7C8E 49B211E4837FFD55 DC614FA3B241718C 1B23285857D7CFBC FD66DCCF24E9FE21 B1299EF8D0B12D94 33906684DA194E5D 1A15CAE0F5C26A90 6BAC63C803F97B1A 66DD0A505F590BA0 20113247E94ED0C3 A615B5099BC53042 43BC7E9A6CE87B58 3DA6DE0131E7C894 426A980E04530055 2213AC017EE6E2AF 1A02B0CBDA96AA99 67C7E45798D5C5DB B2AD02C1C23629A0 995DDFF8A2922907 D2A349A612D524D5 9F73EAB798B1AFCE FACF36A8B1DF7B43 0E17ED7AE7F9B293 A8F4B8FF10C7CD25 A7C87CC5F21B9099 D6C40BD898115E89 D4EBE0BB0028CE4F A1F176E976EB024D B3A12F82D577C34F 2248E22B46B63403 527ED976B06EF0AC D4EFDB1A7EEE2DFE 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ebecef32-97d6-19ff-8e2f-efd478609791
  2 be81c810-cabc-0a99-b727-13cfa2c77ec7
  3 a3646a9d-4059-3663-906c-ca37b858fab8
  4 03bce88b-c4ff-3c25-a1db-7a75de81865e
  5 29bd6842-c6e7-6d80-a598-c30f99abe1e5
  6 8ce1a765-28d5-1f75-b69c-850049824ba1
  7 d6e0ce3e-ba19-8613-a2d7-b3b6b2ccf2b3
  8 495ce445-3731-67d2-bf8e-8adb1989ab07
  9 f5006eee-a023-09ce-9503-596d7862add5
 10 13586f24-725d-09b7-857b-d51ec6e5752d
 11 35fa0575-284e-6ca5-8c81-f4afd2205e35
 12 6343c8c5-585c-63ae-883a-c54988b5185f
 13 d65aa6c5-45ec-4277-9ace-d562aa24f430
 14 a5a2c9cd-c41b-5f15-b6f5-bb6dcd750afb
 15 223ac7a7-1866-7829-8c74-143876bb56b7
 16 abd4ac0c-2e9b-1ae2-8d9f-7ba5c35cb598
 17 190ee3af-bceb-562b-9941-5b985a4d64f9
 18 86d62710-3c86-4b8d-a657-e472e6dfc333
 19 83b4f1f4-0c1a-72ec-b04a-0246a27255c9
 20 cb62f32b-0172-8e39-8c30-68f71655e7d2
 21 f5f8dee9-775b-233f-9a36-a8f10df11b7f
 22 081975e9-6a68-55a7-b889-a942d9b7f7e3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1033618600664571547825. Exactly this sequence comes out of new Random(154).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 0 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs