A858DE45F56D9BC9 archive

201206271256 vo5fi

explained decrypted filler

seed 880

Metadata

Post ID
vo5fi
Title
201206271256 → 2012-06-27 12:56 on A858's clock
Posted (UTC)
2012-06-27 04:54:23
Timezone
UTC+8 · title 12:56 against posted 04:54 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,424 hex characters · 712 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
22
Filler GUID seed
new Random(880).Next(9) ✓ verified
Run
Run 6 (seed 652,173,660) (seed)
Draw
39 · predicted N = 22 ✓
Machine boot
F 2012-05-15 19:06–19:16 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
19 · 6
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

C598619AE1CB19AB 40C9B4831C0DACC0 E3972297A03F09E1 85904CCDB3C7EA9C D92593543C9D140A 2ADF2F162D6BBE99 FEB2E7DBBD8BBC55 021557EBE95E4938 DC7089296C887E22 4FB0781564EAA413 5D568253107D3523 5662AA4547EE042D 4CFFEB1E06930A42 AF7B3F079EFA2154 A671B12E42ED4D0C D494B9BDD6550B5F 137AED88BD023482 36726D0BE4583CFE F530990578BDC78B DD6D38A245F9594C 50A876A0242812EB C1DC4D8846DAC854 544BE8F60053FA08 C6F16DBF56947F97 11636EFE13919BA9 FB2ADDC23CF2E211 797DB38BC27BD557 2A05B9FE8983EF2A 57525242208AC4D6 959D560F829F469F 3756077B4C33FCB7 9EFA419280C1ECF1 93D46ABC29DDC1A7 28D65AC04358769F BFE2A1DA73D602B4 F58642BD7702140E 7303964AC61525C3 5E9BD18651671897 568746F066713547 05B94546ACD16279 3A07740D300C4D98 49DE956A3F48638B 77B1157B2B3E66DE 5FCDD9FE7EA563F8 348A49D73D657120 187FE086CA9D848A 509F56A45F852FF9 B85E5AF326BD317D 6B06E9FBBF7251A7 E8FFB3D2FBA464F0 675F0F740CE384E9 5A646D2EEE7CDC35 F9D38D376CF784D5 F3352FE56826F1F7 AA99BBE3C0272F7E 721CD0AC25F0B59E A36352A41CABFF11 90173767F4C20882 259CE6EEB408E622 FD639852C1BE08A0 9953D9CCDA7E5D60 D71D9346FE18CD26 692A082B6406CA23 AC66E3A75377C8F2 D0B81A13D2CE00D3 A4FD277D7D53AF88 C063A7637AC4A184 33FC8B1CFC97C753 431185C38BE7BDCC A2527D288206F469 CDE7ECDB9AF01B01 1CA785C2C1738023 1C13D0FCE063EBCA 721307C9325171C0 F4800DDCEFB0625D 92204F6EFF1AABAD 57F7F410C5E16766 BF092D426D8400DA B844605CCB421151 EB0C5181F79B9854 B4B5D295D1600DEE A3225EC66D83D3D1 301BDAEDBB3F5579 56EFFB34E6AC4C11 0B43D69769B13B89 4B436BD1FCF5E7F7 2F0944A0A2A9D1CD 1DA33842F2D94F55 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d739c744-2ecf-4392-b71e-009047df94b4
  2 fa73a366-b48f-05d5-95ae-167330e6330f
  3 0750ab8e-e892-75ee-94c3-6c94d91f8434
  4 47524201-b0bf-3c44-a6ac-c6295240d3a8
  5 9181f277-c48b-400d-9673-83e8c59d954c
  6 b5fb0cc1-038e-54cc-98f0-28755ff693e8
  7 a62e9cb7-c46c-1e6a-b0ae-e267f11e7b0e
  8 88f13d5a-7c71-8b39-8b62-106be6804a9e
  9 f53d9a59-e535-72bb-a9a7-1811f54f8323
 10 a32fa93f-416e-6d02-94ba-e7a61559b4fd
 11 48ec42b4-9ca3-58bb-9b4a-babe5a2cc639
 12 ef3efe75-63ef-4288-84b5-9ba69de09d9e
 13 bd50ae9e-e118-5335-a722-feb651911761
 14 3bcfc2fc-6bfb-2cd2-91cc-733c355298c3
 15 6f6c577f-83a8-8556-a456-8d6420a139e2
 16 bc37e8b1-b706-5d40-b1d8-3f4c1ee23455
 17 e73b7c0b-b8bf-7c48-baac-46896644e9b2
 18 3a2b4dff-f3f6-5b09-9d2b-b7ce274ddd29
 19 5b1f99fc-6e1d-46b4-8d8d-9443a7f95eb9
 20 d6b1739a-31aa-0f60-af19-4bd3a1703350
 21 e8e2a59b-eb90-606d-8765-745e94a99844
 22 ba997ba4-1ab3-67be-b70d-6d5896bb32e5

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4073451876545285754066. Exactly this sequence comes out of new Random(880).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 39 of Run 6 (seed 652,173,660): new Random(652173660), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs