A858DE45F56D9BC9 archive

201206272229 vomdx

explained decrypted filler

seed 937

Metadata

Post ID
vomdx
Title
201206272229 → 2012-06-27 22:29 on A858's clock
Posted (UTC)
2012-06-27 13:27:33
Timezone
UTC+9 · title 22:29 against posted 13:27 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
848 hex characters · 424 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
13
Filler GUID seed
new Random(937).Next(9) ✓ verified
Run
Run 7 (seed 629,367,141) (seed)
Draw
23 · predicted N = 13 ✓
Machine boot
F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

A60B521A9D72BD93 F012CF13E781D807 3BDA57EB253B2F04 F6E8A1F40A63640D 6459475EFF224697 F36C2C6832C8CA1B 42FBF9384648121A C8CD4ED9C6361C8D 1CE64C34D8E4F128 473BCFF8DC7B7937 51A1A440BEC999E7 C21C3054BDCA97E5 34F91176B8751FEA 2A7D97FD630ADF4C 4769950F4200C06C 7B06345B39CB38E5 84B27C06DD3F4014 D7097855394B5CA1 126424B71833339D 901B887E2D47CAF8 A620E789F455F5A4 A8C1E0BBB374375A 117F4EF9C06ADD39 D38AE6CD3720F0B4 42B5B9D0BA280D5F 9A8AF58ABD00C788 F4070BEC2BCFD5C0 A78625547FA87AD9 429D32B3CC281BDC A923D2F3077A46A4 2D33C4670E517EFD FCF6E493DAAF0CA1 992EE3E1D39EF93F 34155C8277F11E3B 3EABAA99B62CCD4B 508E7B4EB4D32246 88AC8B884878F12F D1A8DE5CF20D9517 8A60676C3C556FAF 860EB31AF3CCFFB5 46F80935347C655C 7D32918082CF41C1 6153C354267E1A78 146634FC1292770C B378D58ABCC4FBD1 F7A20929C7854D69 26062DE45EE49EB8 F2D3C84477922312 459B6F8077D9FA41 0E9619330716A50D 764154D43D8777C9 5B5CE10339DC805A 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 848 hex characters = 424 bytes = 53 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 13 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fcb63f3f-feba-25ad-93fd-75a302235294
  2 391b7750-0462-64f8-ba9e-ac9eed4d74b6
  3 6a38a70e-b1db-6681-b660-0891d7d3b9b8
  4 4e691d06-98e5-4107-8227-d07a0cd3c43a
  5 2ba7636d-0b64-260f-b729-966b1b30aaa2
  6 0527f162-2636-31f8-92d5-6bcaad65b532
  7 7be6f5b9-58ef-6d95-b911-38985b19ba16
  8 b44a2159-b8e3-4dd9-963b-e33676baaa4b
  9 4e4af8d2-90c0-81bf-a27f-fb453e3cdec0
 10 e224d000-86d2-7f1c-894c-72dc5ec0656b
 11 2ff6c546-e7dd-5864-bd52-0c5053a556ca
 12 0a12c1e7-8570-86a2-8640-4f8859aba78c
 13 41a8def1-92ee-6d44-8817-e5d7026d19eb

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2664236487586. Exactly this sequence comes out of new Random(937).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 23 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 13; the post has N = 13 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs