A858DE45F56D9BC9 archive

201206261047 vn0wa

explained decrypted filler

seed 191

Metadata

Post ID
vn0wa
Title
201206261047 → 2012-06-26 10:47 on A858's clock
Posted (UTC)
2012-06-26 17:46:10
Timezone
UTC−7 · title 10:47 against posted 17:46 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
976 hex characters · 488 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
15
Filler GUID seed
new Random(191).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
2 · predicted N = 15 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

629FD983F64B47C6 1DB68F90CB296754 A75822A82EE6DB56 55278947B7F50CAF 2D0425396785FC0E CBA02338570DE586 98EDA24529BFE228 1C3870C2550D21DF 4525689892A0E4FC A81457F35808AC1A 5D5E99DB710B5565 3B0044FAD6AF914C ABE44BC27D744165 1270CD4B98EE8348 54DD1E6B0F5F52FC FB2A8654A4A208F1 36499E9E5AEABF7F E4E96C9E0081885A C71A0114B2DCDA48 E270864691140DEE F3EE87970A167792 2D920998A83FFA58 9F8767ED3F746C7C 2CA3F3DAA61AFA48 A147D0378B02B24A 3B360430DA092169 6019DB9C6E1FABEB 5C1E84100F453F3F 214B2F8B044F0466 A5127F46AA8A9853 9B93495AEDFBAB48 6C3C95CAA52AFAD2 723806A497DB7720 193D08AD107E1E5B DE31113A5EAB9FA6 94BDE41DA815F4CB 337E6F7446B4627E D9A836B6FC046078 BBC026A207CAED89 36C4740C2A1CC7B0 1A1BABD965953945 DF428ACB24807FFE 6AF7C7F4AA6B1F17 B48FF3A561A611DD F9277356F4DD1894 7A51C12D2D26CD19 05C85A9D162699AB 32F1600BDE7902CB E7A3DDD58BADF2BA D07A4613B17BE742 4E3422CB41122BA4 752D39B91BF6B9BF 031B6110E361FFA1 E9623670308F8B32 8144499CF88270FA 702C7316204A9D42 B35266616A4E34FD 5A801EB7857EC02C 3F86285AA9A0D595 90FB19757DD3318D 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 af42673d-3a91-49a0-91fd-f43f14aa8985
  2 acef8760-c6d8-7082-baea-b63da6ab7fad
  3 94a814ba-ba3a-2569-93cc-1862075a9cf4
  4 032505d3-48ab-2cc4-8bd6-4c143459d641
  5 e3f3bda7-6173-39aa-9b6a-ac88d976ac76
  6 3895fbb5-50f6-4b91-b349-b37b1a53971e
  7 b33f68ad-ec5d-4169-bef6-90b5e7cefe6e
  8 74286061-463e-2667-b07d-2880ab45f67e
  9 dd8b6ed5-f03d-58df-a1c9-7174495af9e3
 10 218727b8-ca58-65ba-b39e-898ed610f885
 11 a591f355-8ccb-03ce-9025-75160c12aa68
 12 e72bb2c4-381d-5d4c-9931-be7dc4807034
 13 2d2f14e3-3e0c-8718-abb7-1f5fd20826b0
 14 8262cd65-768f-76de-bdca-69a5c356402b
 15 ccefc88d-cbbf-6284-8f71-d5ff56b63d7b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 472234425605876. Exactly this sequence comes out of new Random(191).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 2 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 15; the post has N = 15 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs