A858DE45F56D9BC9 archive

201206261056 vn1in

explained decrypted filler

seed 152

Metadata

Post ID
vn1in
Title
201206261056 → 2012-06-26 10:56 on A858's clock
Posted (UTC)
2012-06-26 17:54:58
Timezone
UTC−7 · title 10:56 against posted 17:54 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
23
Filler GUID seed
new Random(152).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
9 · predicted N = 23 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

C647C7F9BAB2A8D1 DE7B5ECC2A0B257E DC60D2A86D97FD5D DB04216F49C3A73C FB73A9073DDFFEC9 E6668903A5D3E416 0ABEFFFD22D929D1 4F460236AEE4E616 294873A367ACDDA5 3890431F45D406EA 64FA083012FB765E F70DF4A080A4F5C3 BB40EA74C6FE52FE D56DD408767FCBB9 C777BE7D4782AA4C F19D78AA921C4EF3 8007AB457D0875F1 BDE8F70AAA19BAA3 983AA65F2ABD137A F52E0594F18BEEEE 08AE4FF5336E2901 311E1D619D4784AD 6624B5F4B4D50001 BD134EF81330EB44 A99735E2C37FDD40 46880401ADA93CD1 3C7A03ABBB9694FC C22D95CDD7978613 CE262744F2AD8BB0 2EC041736A96E6C1 1986B2D77E8EAB4C 40C4C494B3383AA3 05E312A270B888F9 6FF83BEE0FA6C17E AE01A17C8FD4A136 3D30899B39B067D7 02C64D0673158277 F774911DAE9A0119 0F420E305DFEE2E9 29FA9371FF09B926 43F3056B76865CB5 15400E252A8CAFA4 AA21ED709792415B B61F99A94A9DDBAE 0B44936A9C91D5E7 D0DE2C116D8EDBA8 4BC50CD93AF60F5C E7AC5BBB3E826675 DC1C2B639DEE4C2F 3C9B911D4ED5F8FF 8EE865244BAD45FA 348B93269E9A8EF7 465D972C85E0F8A5 E5E2A0201A23B715 B4C175A9AC396200 E3A353EF97217340 F1B81B82CCF91726 EF81DA25E105422A B8F0C294DEE8A00C B21A56D6E013A685 CA700E2CABABB884 56FDEBBC8D573871 C2B316CF55DBABD4 B70D69289378FAB5 DB36D7C3E70F8B0B DE3CAC2903E88F74 FB7187B46F787DF2 85819B02CB633E9A 82DAB0F223B71C57 CA352067447B4875 3DC7A820A5FC27A3 0EAECECBF79CF6BD 38D6BA2BEBBFCD85 E0D2277F9E8BECFD FDCD6ED352366A65 D2DBDBB767FA6F48 EC09ED72FBBB40C3 6E40954900B1FDC7 423525005CAA5C96 A9BE1FCA8EC3961F 1F354F1EDE1D9932 E5EB9E2C20FC9D93 D666D2F640FC8787 2A14BE72315B0F03 5599E73B5D734673 91D98BD20EA53961 DA035936AB40FAD1 ED82C08FD5118541 4C35783B619979CD 188B1ACEC1182902 186FC69114AA7925 1E29FE5527C4AF4D 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e51b43ff-e8bc-12f6-afb2-10f8ddcc334d
  2 d552266b-2adb-3e5e-b538-cce1f61cb59c
  3 5caefd10-a167-0841-b017-56e8c84a4af6
  4 471b5098-88e4-0d4c-9d85-8261438ac4b9
  5 3ab3c021-861f-7055-b36a-dfe3fc1f2ab9
  6 cab9c50a-ddd7-3db8-93bd-a95bae16b5e7
  7 5c5f6da6-25bd-06ca-b317-23d7e05596dc
  8 2041d163-6367-6ff0-8ba4-e5b4977e321a
  9 d1e0a88b-4db1-745b-8afe-e5c1b26161bf
 10 071e2e78-ecc2-28ce-b44d-52db76bed23a
 11 95945fc2-50cb-2476-81ef-2312b6fdab91
 12 7a3a12db-94ee-1fba-922a-e34068a189d5
 13 1a8d0409-a417-1ee4-8d63-b65a78a2fd78
 14 f29322f0-c7e6-4445-af95-acc540c09f53
 15 e5b3bb6a-4065-32e0-8a84-c5f36cb18de1
 16 d72655f8-ca1d-82ae-9686-f676fd77621d
 17 0eac9b10-6aa9-6625-adb5-1b784e835988
 18 8834dfcf-5bc0-20d6-a18c-a315efdfc0b3
 19 871fd97a-3e11-7a51-b011-569ded334d12
 20 c4abe45e-d737-12d6-a3ac-b566e31ec900
 21 42c69bab-30f7-0936-a264-b6daca9c20c8
 22 057d18cc-7d29-107a-a1af-87ffc9f7c0b9
 23 89811580-982a-6f63-ad9c-8a667b0e1bbd

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 13007306722114386271016. Exactly this sequence comes out of new Random(152).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 9 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs