A858DE45F56D9BC9 archive

201206261203 vn62v

explained decrypted filler

3DES(name) ECB, 23 GUIDs, seed 656

Metadata

Post ID
vn62v
Title
201206261203 → 2012-06-26 12:03 on A858's clock
Posted (UTC)
2012-06-26 19:01:23
Timezone
UTC−7 · title 12:03 against posted 19:01 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
23
Filler GUID seed
new Random(656).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
68 · predicted N = 23 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: seed

From the post to its content

As posted (encrypted)

7D49629DDF9C4047 6862D3062FA8E32C 3E2B8BC7FEDDBE7B 92F1C66C3500799E 6A2BBE15A2F4D8E4 BF685101C9F2BEE1 83EB67C2C60E3E8E 77CBDA34E678E3D9 15B61AD5C3486AF9 0103EA0B9572B929 4F19405FAAC73960 F708DE88117DEE9A 9FD9AD62F89257B1 854D53675E961AF3 BA247FB001B56C3B C56CDECA9F6D5C3B A4C9209B0FBAD80C D8CB2F6356D77E8F 7F3A2F3D5E131783 CEC3D49BAC174CAA 63E33F555360EEFF 73076AFBE86F7642 B9C524E7040CA321 0201F1588E137241 7D6FD447B887A040 E912852D468D5735 3CA9D4ABBEA0DD61 F2ADBDF9B857FFD2 D5FEA2DAD630E443 6D5EEC902BC74D89 068608C8C60028FD 3EE326391B60FA86 ED474FB88C40EA83 16D82F55D97499EA 574DA9BBC47985F8 44A922C1A5E692C5 99E8CBF4AF8F1371 860765803DAAF083 4DDBF66733931A5A 23D347562677D993 3ED11DA01CF30A23 7F672ECB3DC1ED12 8550A9E257FD8353 50922AE6E923E82D 1C4013482FC899DB 863EB9338147518E 7AF561F2E8FA608C 6ADCE106DFBCDAA7 F3570BD8CB94F194 9F1A8E19D9F7E1F4 9A9AA25DAE980980 8C29F2744FBFEFAD 59590CBC06F52BE0 6855B562CAB74D60 EADB0E0E47C1F4B2 803BDFE16687FB57 1AE7054A0CF331BB 25CB22137CFEF5F2 1FC50FF8C61BB1C4 534B3A26C30D2942 39D5352A8E28D0FB 56188062BBD2ACA9 76D396D6372C4E01 7E373935623E70CC D24158AE50D6343F 04A0E080885951E2 5B94BC1D73EC90B6 F68639E4E9C9BD08 03679075B86CD88D 890CCC4CC3B61DCA BD94D4814B224FE2 1E647A6836AE0199 87EE98000E465576 442E8171709BDBB9 5A872C6264BCAF20 EA1816669ECBEF95 BA0AC85E5F8204B3 7A2BAD5E231BE741 2717FFC30BE79F52 D11D49FA7B0758B2 C8CB6A3D74B9D943 7061996CFAAD8EBF 34565945D37A1E10 3BADEC3525CED618 32DD0A04A0233647 7AF6C5BA8AFA979D E981CF08BEA1B6FE E876FBC8DA938AB3 1805F31A7F047041 FB11FA47A33BA2D6 330E534915D36D0C 1485CB41BFA0D172 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 06317b32-93f1-3bb0-8ba9-41318bc9d3e0
  2 c1225781-77d0-25e4-97ff-58edd1378baa
  3 b3a9feb9-e505-22ae-92ad-e86cba0ffcb5
  4 e6e9bb55-ac40-54d3-8eea-123995b366f6
  5 c0a29477-0e20-330e-9e44-4e1e444d7a7e
  6 b076d09c-08a0-748d-8c2d-7efa066491c6
  7 b1a9a8cc-5fa5-76f8-9966-b0d90edc9576
  8 75e2f344-7fc7-4e73-aaeb-39ca3f394133
  9 8fad4211-805f-16b2-8396-98e89cf981eb
 10 87ef5497-9221-1245-abb5-96879f6ceefd
 11 99856847-7408-5517-bd13-f9815dde19aa
 12 f667042f-7cc4-5f17-992b-225f27f0179c
 13 b2123b64-416d-5bf3-a913-0e2270e29315
 14 55fd7115-19ec-68d9-945a-9d3ac88083fc
 15 7bb70479-da08-1401-a40a-11f6ba137369
 16 c0f92a5f-1703-66e3-965d-68c5f9a684e9
 17 f21586ad-a485-5938-9f31-01fc0b6cd3c5
 18 0535086e-1041-6975-b0b7-cefdee14dbc1
 19 39055e7d-2021-324c-9420-39c985890f5d
 20 7d10f131-be33-2d7d-b408-5725d266a167
 21 cb3667f8-25a4-886f-b35f-3a3cb191447e
 22 7b269418-1eda-7e91-9107-7cf08c75a23a
 23 e7307e40-6428-7d99-bf8c-788e38b87d35

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 32253774115556165632877. Exactly this sequence comes out of new Random(656).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 68 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results