A858DE45F56D9BC9 archive

201206261047 vn0vx

explained decrypted filler

seed 264

Metadata

Post ID
vn0vx
Title
201206261047 → 2012-06-26 10:47 on A858's clock
Posted (UTC)
2012-06-26 17:46:04
Timezone
UTC−7 · title 10:47 against posted 17:46 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,040 hex characters · 520 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
16
Filler GUID seed
new Random(264).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
1 · predicted N = 16 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
18 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

4C380147FEBD595D 62F8D22E121086D8 24DE84F16CF5CF4C F5CDEA12B6B40AF0 14B65861585C8F21 2AB223CE3BD9190C 138EA04811D85F28 87EEA9CE8076B778 DB43718C752405B8 81C81394787A97F3 4DD9D8A1A6C43444 E97D5803B2A3BE70 80FD7510BA71FCD7 891580A9B57B6345 1A9D58DEDBE70390 1F57A6E4282B3946 ACCBC421C5225F22 3E255C94485DE714 2A7E111B451B1AA1 D5213DE6F7AB64B2 B6BBB367D762F581 5A96171CF7191F0F 10871C5EDB86E33D 2CAB13B4E93D7F1F 057F41D7382BD0B3 827C940F6F27F82C 62537FFD937CBE2E CAACCC79D9E2F1C1 54AA658F43CCAB75 A698BF287699C807 E7B30FDD3B54AD69 78F01FE28DE1EF9C F8118EE55EEBE4F7 F0C0DD26F58FB1A6 A92E8CA72B27753B 8E324B215FD45AC4 D305DB816C1E2CEA 83A4D08D639C8A12 F33292E6825E3D81 4E7041D4467D7F30 1FB03F96B31F2D97 8D78084999310822 4A0F2EA49C55211C 7E2BECD9AF5A0E73 32B5A806615404A2 56E50382C5D3E845 68C6A322D0C778E9 0FFEBD43A1F0EF10 715FDC53AF8B0336 3A64EEF2F570F558 44282068984F9FA4 63AF948504E4E0CC 9F0358093033E5DB 9EDE647F608A16F9 3FA5DBA2CA3DB9DC 68377A4D71180569 81EAC3F79AC44D7A FF3C52EFA001AFED 1F9417E541A918E6 B3A238C8228A3E83 FBBE134165D361C4 ACFF446F36D4D2DB 041EBBD78E0ADF62 870CF4673ABE0707 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,040 hex characters = 520 bytes = 65 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 16 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dfa9db65-c125-5251-b33d-21532849e701
  2 a564c8ef-80f8-2315-ab79-033831a4d062
  3 9d106dba-7648-2a55-aae3-80641220ef08
  4 de7231f6-ab75-8bba-bf60-8db325d49e3a
  5 5b747388-999c-35fc-af45-0c63d3316bc6
  6 41912f10-1e67-2c35-a40b-785759eb1e95
  7 a9bf7e93-0d2a-1a56-a963-db45ecbf5bd9
  8 eccb0985-9479-7bbd-bf14-5287742db2a8
  9 1a06e7ff-7cfb-5640-94d5-f245d4848a4d
 10 45deb1a9-d0ea-5cf7-92eb-bfeb1839b282
 11 7410eca7-c668-7e2e-a86c-568a7c87fcfe
 12 55017096-3fcc-5ea6-9565-cfd3f74d851c
 13 f0e6a759-6364-112c-8fab-12884c8e0e08
 14 72bc92e5-9fe3-70ed-8d82-d30662d91964
 15 d0f8a4a0-154b-6d8f-9c1e-6b3ab0887c9d
 16 30bccede-2645-811d-a5f3-f4fceee307e7

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5228321755751768. Exactly this sequence comes out of new Random(264).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 16; the post has N = 16 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs