A858DE45F56D9BC9 archive

201206261114 vn2qy

explained decrypted filler

seed 44

Metadata

Post ID
vn2qy
Title
201206261114 → 2012-06-26 11:14 on A858's clock
Posted (UTC)
2012-06-26 18:12:33
Timezone
UTC−7 · title 11:14 against posted 18:12 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,296 hex characters · 648 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
20
Filler GUID seed
new Random(44).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
20 · predicted N = 20 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

455B34423DED0C45 2EE1695281D12B78 1E87425F49978A8C DAF6EC9ACFCA8D02 FFBF28BAC1651264 C4DB71000D9D88D1 83071C5C85559BEF 3FCDF6A3455AC7C3 59D09A4CF04988B7 3EE9C1316E258106 F21A2B556CC163D9 9C87FCC1E9A1F0F9 B14E9CE4CBD9BEE3 75DA14692212B923 178F32C5AB182E41 6666DCA72496BB33 76AD37A13D584980 E4A34631F324EAA7 D6D63600D076119E 953D04C69C39630F 915B92873B05E399 2DE1B758DA36D11F 8729518385C39EF5 A5005B652B0D079F 0246E573563C21EE E2CB9E1CE7E6F987 347D7F119F041997 72E0C9A2DC5F4CFB 922E33364FA261F3 E727B14657A8CBC8 854D7BF8500BF9F9 DA408F2AD70517A3 F2A027DD845C1412 ADF0BE3475F7884F 1E174BABCD380037 BF30FE85D74A602E 112B860DE344FC8D 4BD92A215346D28C 7934A4714A233E49 8C630792D7BA1F13 15BC06A29521E86D D2DE79FF6370AA44 731C405F7E5CF59F DD85A36C1D50D554 6475F7DA1A6FAD12 74279B01686F45E0 2398135CF3825325 2A5EFA69B103F554 E60939F303B0F7F0 D7BB4DF681AEB64D CAC6B20E612BB518 7BB974876BA5CA21 C08B78575C0A4C46 58683E89F9D084E0 C4C4DF04A4733C6C DEE1EED1F29B2D17 A41F1EB5E2BE6B92 C60BEC9FA863DCB2 DD7B5DCD65F7BC0B B699640959D27566 5DC8A244B315AD27 7B4C64448E757A5C AE896782B1DFE631 B76D89D4AC4994FE 5C57A9B78D34C58B EBFB34C2BD2DCEDD 4CE4DC414CFECFF9 020832BB41A89BAD 95A06BEFC7AAE487 3D561E99F7CFB18F D871C3CBDC8B9CBB 0AE6453C70E413EA 4BF0D79AD99A155A EB7D004F725AB186 BEBDC77D8C8BD148 7636D2C724619F64 0A7FC5A443262F7F 137B1FDD185D4947 D03BCB9E6A44F923 6951BDE59F545D10 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f340456b-6b23-63cc-8c86-9c7525a9f81e
  2 93c27e52-815b-67b1-ac9b-b07cdc90b1b7
  3 d0f032b3-653d-42fb-90d4-c8870367b5f5
  4 9d02c92c-d75b-8736-9708-bc4299d474eb
  5 c132194a-7f3b-00f9-9155-263de23cc1a6
  6 ed9de709-d820-0747-9d9d-d9093a9fa6f5
  7 6b79a4bf-dc73-58c6-b448-b1aaec7b45b7
  8 c0d40266-2556-4f56-bf52-9d4a33a2960f
  9 213fd896-ec3c-387f-baac-d7d0e6dab87c
 10 4a25196b-29c2-4af4-bd65-99e720a3e9f8
 11 4d82a508-94d2-6c0d-a2b6-5c7898cc6d04
 12 60b2c256-5592-7ed1-ba9a-366e3dd3bebc
 13 3f369d0e-0013-7e07-9c95-22d5c2f65425
 14 0bc32ad4-d361-3bd5-b2d7-37b4557eb598
 15 fe708b6c-b9ca-79a0-ade6-5e701d1f6196
 16 6cd92e3a-23bb-4b1f-99f9-3561a3d07d14
 17 ecbf5676-0cfb-374a-8e07-e773f714c91e
 18 c8916e3c-a288-29db-b85f-f9b8430a510a
 19 4813d39c-eff3-7404-812d-0459d557adb2
 20 1cb6eb7a-6b62-3c0c-911f-a7b98cf9d4c0

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 66480054346773743273. Exactly this sequence comes out of new Random(44).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 20 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs