A858DE45F56D9BC9 archive

201206261238 vn8el

explained decrypted filler

seed 209

Metadata

Post ID
vn8el
Title
201206261238 → 2012-06-26 12:38 on A858's clock
Posted (UTC)
2012-06-26 19:36:38
Timezone
UTC−7 · title 12:38 against posted 19:36 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,168 hex characters · 584 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
18
Filler GUID seed
new Random(209).Next(9) ✓ verified
Run
Run 3 (seed 1,063,142,882) (seed)
Draw
75 · predicted N = 18 ✓
Machine boot
2012-06-14 10:25–10:26 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

AF93382042F80F4E 15CE93397E7AC165 FEF344E56675924F C2A768F057BB601A 2A956E105E6514B7 A6837DBC4D8910C3 888BBDAE3658D0FE 3127C2C9D478A306 480C578CB11E04FB 68CAF88EA1D697CA 0EE9BD1D3D27AC84 AE26F61BC7DCADD3 01B7DEB1DC9B02E0 BB7E601FBBCA23B5 E3447ABF30D3C35F EBF62C911CD49EA6 8C53013F262ACD5A B474774496B7244C 000D844EAAD7F4CF 5F728597921126FC 1756330F50899802 8FB8F7CA33095C76 1F3AF746C0DA8FDC 6FF3F4FD5EB9BD41 17DA981874D94D62 30F344B72B5F8A08 C5D153A880466B66 87D0EE987DD902C5 ADEEC7F17A715D06 D77BDDE186797B64 2B0F24880427A031 F981551AFB96C061 74F7A8B00F3BCA2B 51A840474CA80839 3DDD99E7747BDCDC 370513D4E98E640E C37F57599EC6C474 4549BD0FDB840658 59CD346EDF0A4F42 C1413C76E921357B 0368B01F88415093 E72EA6338C7E2186 078BED6F4DF218C3 332FF4E61538FACC B6F63A619B2111DE 5A708E5F4AC566B9 C532F4FED812E671 6EA8D5A31F0DC0A7 6E5492438BE55172 FAD2CB8CA892C32F 003D9D77BB167A17 33700DA681515295 B88A5506EFBB7CBD 584F82BB275B18BC BF8633FAF130BA51 CF0DCFCAA7A34CF6 2DA3C9FA489DF839 BB5D2049885B36CC 38A686CB1C3B1104 65E6AA46F2D88568 8277EB6DC6838E8D 2D5A6E7215A956FD 6AEFD05ED9F4367E 01E8923941763029 5ADE7F3AF1D051AF 06ED4C2C16A7E103 E23D1AD0688CB7DA 44F660807C5FDF66 1CC9F3B97D1CD3C4 D8DAA852706F1DA7 6148E413618277BE D4F6A29CF9A722DC 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,168 hex characters = 584 bytes = 73 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 18 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fa6603ec-1a74-8219-967e-080cf40a979c
  2 04870a32-adec-136c-a7fd-d708be6d4aa4
  3 c9a005cf-9ac2-7086-8f72-fb58161f77bf
  4 ed2a7099-51a0-1922-b2d7-9c66d1bf5180
  5 ef3b367b-eff2-5184-8c36-9fbb4fd38b94
  6 45d46ec4-c957-1389-8610-9788a85329c6
  7 55f2e856-8d0a-4b33-84aa-b3fe914fcd89
  8 0f489f85-ad4c-267d-8183-4d1b3c3f3040
  9 ec97646d-f510-7ed7-b5c1-021bf064874b
 10 a8d73f62-bf58-377c-8683-5fd258bb5239
 11 7a6c10c1-960b-2f4f-8cd1-98c0f245521b
 12 db56dc8c-505b-5cf1-88f7-894c7e527439
 13 add4bca8-324a-2e19-953f-5d50279930e9
 14 1b16a970-e4e3-1244-a24d-3da4d5bb90b9
 15 703b4e81-d80a-2933-86ff-1b13c7736a3b
 16 e955ea53-5505-46ba-9e87-bf3bf06cb85e
 17 6c290ebc-f25c-6f3a-b35c-4f15cc16abb1
 18 7c9821f8-728b-50e3-9347-e9ab345674af

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 817151427325212465. Exactly this sequence comes out of new Random(209).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 75 of Run 3 (seed 1,063,142,882): new Random(1063142882), Next(8,24) per post. The RNG predicts N = 18; the post has N = 18 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-06-14 10:25–10:26).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs