A858DE45F56D9BC9 archive

201206261122 vn3at

explained decrypted filler

seed 192

Metadata

Post ID
vn3at
Title
201206261122 → 2012-06-26 11:22 on A858's clock
Posted (UTC)
2012-06-26 18:20:36
Timezone
UTC−7 · title 11:22 against posted 18:20 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,424 hex characters · 712 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
22
Filler GUID seed
new Random(192).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
25 · predicted N = 22 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
11 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

6BFF4EAC7D61494A 371D50842D92B98F 5BEF44D3FB5F4B3F 796B8C22FBFBD6F8 35A3F528B1170256 D29CB307513274BD 7B03968678DCA215 30ABC517585AD8BA DD0087C1A691E527 BBA45F1140E312C1 0FEED312D6E982FF 68FFB69BA212571F 77B6F861A68AAFB7 FAEE7C921CEB5A6A 8167328A4DEF7D3E 6CAAD39890E76D30 0DADDFF7E1483735 0570332387D08EF6 20FD5AAC853C71AE D41BB54C79A028AE F536B38A717D6B19 5A6C34CC249740C0 122BB9D2BE0ABA1B 56E761EB21BDD062 04BF4C5D5D92C593 5013D7E942EED18E B7A009E1B132DE0A 5AA2108679ED0585 E1F481FAB7CE7B99 4AFAE133F8435385 DE22971536321D28 FA59DCCE1FF7E2B1 08A493782A3F5EF8 0AC6DCF1BB03F408 48978876A2ED66A7 0782745C65889B55 32636FB08627D6F7 C14E09C5E2C0E473 4ADC98ED46F9E19E 0AB41F4698C44A08 27F299D437ABC871 843C86C5925EDE45 84C3367FA387478F 35600B22502854AC 8A3D370C064D3655 FC5D2B895CB21E52 CEB707A6F906AE3F 6B85FB97429C4859 A69930ADD0B11E8A E702F430E97379A4 1842E943A8B8E50B B44966B7C8B743DE 7546CFFCBC101A2C 764C60304739B25D 1A88D2D1D719A4D3 54A0252D0CF3072B 16AB7E2261B1C3B1 6C3A36B187DA46BB 66AF0D8B408E2A63 D81CF19C37035A88 4757E644DD640AAD 44A22BAE15950F4F 0932342D2B42E2FA A302AF77F43B1219 C96D5019D3AD56C1 332FC12942AA6144 FE974E1372A176FF 87568BA3A6AB2A95 17979AD94BD4AD3C 63DC01FB91A18845 8D81AF12D75DAD22 67CA0C14AFE93767 A991A8AA239731F0 00E1BF546FE87679 D258B8CD1125F64A C53D0922C17CB6E3 904CE317DF8ECFAA 0A660BFBD2EB1ED8 E82855B6E856A0F2 AA2A6AE88A9DF9A1 C4241E934667B6EF 36ADD187AABE29A7 47F46E5DC69151DF 94E751FE097DF86E 828C93A1AEE3628A AD0AFDB8E8F52D59 679160186F4F1DD1 606446B6AB3E8E9C 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 51a6f243-0c21-03cf-9a8f-cc3808dc255e
  2 f7574f24-f79b-1194-8cfe-cdc09ce40d5c
  3 47aabae3-f220-8847-86d6-a93feafa5ec1
  4 d0b43246-2e1b-4aaa-9a99-f90bd1d4312c
  5 73f24ca5-5875-8d80-97f6-859cf9abf63b
  6 e69c33a3-d4d6-349a-ba23-b57894e15e3b
  7 365831c1-fbb9-8e1e-808c-9ba74733c01a
  8 b8c44aa7-2008-6912-9705-e84ceab07b46
  9 3e3e14a4-4df5-6b3e-ab96-06a3b5f0e6fa
 10 404278c3-dd11-0bf3-ac47-da4804bb8a7b
 11 a850759c-8b1d-65ab-9097-878a73e4751a
 12 9c02bd81-7371-3907-87ae-65f2d4b74702
 13 b5724695-0c7a-51b0-aef1-e7c29d82841d
 14 cc734623-9a62-3eae-9cb6-a2897104e9f4
 15 bc25dc78-e46b-35ca-aa71-281012e2d76d
 16 d9e1298d-0bca-8622-8188-1a56a1951361
 17 84f61b4c-8191-5560-9ec9-91c57346856c
 18 f4455830-48aa-097a-887f-01bc3117270c
 19 f2648f0b-f6a9-7a70-baee-2050d31f752c
 20 c2c44f67-fbf5-5b48-b9fe-001bd12b6c96
 21 c65ad032-2f6a-247b-94a7-cdfae4905200
 22 cbff2715-21f6-8bc5-b121-d0cd3c8e3635

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0184838660635338507528. Exactly this sequence comes out of new Random(192).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 25 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs