A858DE45F56D9BC9 archive

201206261117 vn2yu

explained decrypted filler

seed 581

Metadata

Post ID
vn2yu
Title
201206261117 → 2012-06-26 11:17 on A858's clock
Posted (UTC)
2012-06-26 18:15:45
Timezone
UTC−7 · title 11:17 against posted 18:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,296 hex characters · 648 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
20
Filler GUID seed
new Random(581).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
22 · predicted N = 20 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

91B6CB4DBD205D77 CC2D8E46F5A92B39 52D0F66C3A6279F2 84885675641206BB A836AE1218510D45 AF5C4A8DC50C8985 3A4C07CE8C03FFB4 B1367A46A38BEB0F A7E569EB65B09DD1 296D76CB4A6DAB62 C0EA1740CC9C8B85 681FDA0DB6A8CE9D 7B4ECEE7F1ED1F20 974434AA7D3E7452 494AADD6006F5ADD 7504E55F64BB410A AD178B1AEFD95172 104C3ADF072AA15E 1472F06B91CDE3A7 8E6B2372B80213B6 C29A96663D568755 F1A3D5F620F7880A A53ED17C0399A13B 0744BBA5BA0222FF DFDBACC973C4CFED 02FABB874B7EF45A C5A7948789B3CFD9 772DBEAEE3DD18BA 16D38CA5A6709289 9D9557C5BD0CC236 D0921893E00AEEE4 B1E4996C728D080E 24E58BA430578977 DF748D929FA53AF3 600289E51C89C4DE 87DDCC4B15D33E05 1972B3FAD9C2F2C7 375601E07CCBB176 D603C723A2CDB167 356D8BEB3D40A992 BC568BB272514554 AA1AC0E02FCC8315 B28B57801010411D 35924A80B4F39E3C C757095C9C336CD0 BD76501F582D47E1 3E407F508AE7D11A 5CD9F85B7451C5A8 3AFD99BD19EC06EB 64B69848A0EB07E4 5BAC183070731B56 72204A590D90E939 70DD57D16EAE514D F075507DCC673D97 17356733BDE77DD0 AE20775C9451DC70 B8E6659F18F9DD51 8351A1E31CEE9708 C4BA447B9F140BE0 AB97064CA14B6B2E 554DF33F4081043C BA0DA13CFDAC03FF 4ABA8EE1A521E621 4EF770E37186F27D 5F0607807F2F419F 477C2D947D40D45C A5BFF7140E66081F F860D22914976784 485405162430CDF8 8791ADA92823B97E AB3CF151BBB02EF9 979E8272C3D6FD1F 0700281CE57D896E D8D8ADF4C53D01ED A585505645918689 F23DE556733FA082 6CFA0A10DED64E99 5E83189AC6F50D69 23310D2DD4B17178 C92BEE8B550D7B95 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,296 hex characters = 648 bytes = 81 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 20 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e750ada8-a757-2be2-add3-5d73ec67a1df
  2 3904335a-9185-285d-b7c5-5fc7428ce5ca
  3 8348ca74-5384-7bbb-b55c-6805aacf83b6
  4 40955b49-6c34-5dc3-b763-4652731a3920
  5 49f5958c-f67d-4861-a55c-0feaf156d354
  6 eeb3159a-5186-2715-a505-03e531b536d8
  7 129fbf91-58c1-26d5-8b3f-2417bf2d395d
  8 3fab91e0-f1e5-8dd1-82f6-9928a959f5cb
  9 2d3cc3b4-c663-7199-bd1b-4f4820719820
 10 74ad2d26-fe6b-4b8e-aa05-c02a48778373
 11 b4e3aefa-992a-2bbf-a46d-6b03018faa4a
 12 8f99c4d5-2aaa-0ed6-8159-7e0472158537
 13 8138029b-1566-0299-8ef6-e8d489cbcdd5
 14 715bfc5b-f753-6a83-baca-ec690328d79b
 15 775cdb58-8f74-5817-ac31-157c8f954e93
 16 69efd90a-ce49-7bf5-adf6-f7d96c45631d
 17 bd544f59-4cc3-0ccf-9447-43d2d3e39944
 18 6bb7ec47-7267-1a7e-a543-6fc89e40bcd7
 19 31168998-fcac-3cb1-8e46-64a124a3be4a
 20 1886a174-6635-2792-ace4-9171ca3960b9

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 22754228742006570132. Exactly this sequence comes out of new Random(581).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 22 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 20; the post has N = 20 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs