A858DE45F56D9BC9 archive

201206272300 vonsw

explained decrypted filler

seed 619

Metadata

Post ID
vonsw
Title
201206272300 → 2012-06-27 23:00 on A858's clock
Posted (UTC)
2012-06-27 13:58:35
Timezone
UTC+9 · title 23:00 against posted 13:58 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
23
Filler GUID seed
new Random(619).Next(9) ✓ verified
Run
Run 7 (seed 629,367,141) (seed)
Draw
25 · predicted N = 23 ✓
Machine boot
F 2012-05-15 18:57–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

96711F78B540210E E6A6EEACEA5EFCFA 8C35E425C14F24D7 4FB9C7F2236136C0 01181DC9591883F5 C9AF55BBD10BB25D 89CB736DD291D46E 56B6CACD54DA273E 577554D9CD0A2716 03F8E2147E4D1AE1 1676419A75065BE9 2E0F76E74EE0D839 8E7B2AE99DD51505 6476AC1BC0E9EAD2 0FB20411E22A7429 2437B835CC54802B A5BEF86F630E9578 D8C87D7A1337F490 21E4F8258E58943B 373203C5C3330F22 55D011673CA37E98 DE563D027A472E54 DFB8C86996B84F8C 03D47679E875BF75 C2A53374B24802F3 F2C88C4C43BC694C 4E07CB411389E7A3 5B9742378C7F5E30 484A904362669D6D DD846B7BAC1A8B2F E58CC6E392408697 ED204414DF42805E 36F5CD2F8569C73B C7D7CBC9CB65AF28 1F7CBC30ECB02126 5A3E7F68B12AA0BC 42109545B0C3D30B 3658109754B4FBC8 878C614A5C40D679 55B22E9EAF82A79C A059AE5552959F26 85E0F4438FC15F04 BF22D2A9B853661A 9256E6FB84F4A31C E51B9FB0BC723985 D0340BC597068E9A E551227D011639CA 894B5158F9E7C92E 8015C37E24730B63 B70BC9D4014EB580 3D5DC95953D4AA09 41F5946E6E1C04DB FA7D8199932D8486 F7B6F61A20DF473C 0E0BD2ED4F226CDD 3C3097784CECE0DB E6273CB7634B5FE2 B0CC839FBDC4FFCE 5CCBA54A1495447C 83D0EBCF277B56B7 0BF46390DBE63730 F404FF7E687461C1 5859E553EB8E7409 D5E9B1D54B37AC7F B26A0CBDC24A7802 97B6DF178FE44619 B8328E30DE91B3CC F3B84B0B5C3D39E9 B3B563133732889B 3AA0DC12D44A9598 22C66951D296A775 8177E526EF473064 511F096791074396 6B8D81136B8C484E 618E487B2BA2D288 090CB3A1C3155717 A047482627E1C08A 0034CDA36242EC41 69D5BCC526BA1667 E5B354FD98CB1212 9DCEB408D92F143A F5E16C2072798A33 23434D85D23F6691 088B347CAFF59879 6BCE8F72C1C6DD1F 4FD83D031F5FE43B B6A44E2543B8453B 8E412B204975E762 5C98DE65613D4280 F6210605FFB5D2F1 C4992A1964567EA3 A936639632BC3BFD 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c549fc1b-4667-0c55-abf1-b0175d18dfda
  2 955af9f4-f7cc-3fe9-997d-ab91af9069c4
  3 1e63a0b5-8d3f-3ae3-99c1-1cb7331595ae
  4 694b8856-5e78-68f8-9657-a04f619d13f6
  5 d0da5463-5d0c-68d3-a42c-94987a741741
  6 8de4d90e-8fb1-4c2c-9706-01540dabc14d
  7 412e031f-82a2-21a4-a70e-d375eb059b13
  8 ab714375-b698-801d-b515-a9dd2a36f806
  9 ba2fa447-4a95-5d10-8201-88e9ddd7560b
 10 5b169cc3-0e75-482b-8274-d386a8e4cda2
 11 9b3b4ffc-3f75-282e-a661-4679e313fbb3
 12 e4bd45ba-bb60-6f54-bb17-7af445230622
 13 efe2e500-cb34-17d4-8c69-6d23fefeeff4
 14 af42fc91-1c80-408a-9429-bacc75cfd35e
 15 b002533e-3da7-231d-90c0-6e3ef87504b4
 16 be965f20-4848-55a2-b2b5-28c430fb45dc
 17 c1951350-d849-0716-9bed-d0034e2c5e50
 18 6f1e6517-13d5-6aae-b5c9-2f4531942801
 19 64bb1014-621e-3c4b-9bf5-03bfc70e0005
 20 afe91f35-1f7d-8721-a490-50dccc8f0abe
 21 473a9d8e-0fbe-086e-92e1-2eab7cf7f591
 22 741df1c3-3d43-6af4-b6c6-c41b8d5f8b87
 23 f98388a9-cb7f-5813-a93e-802a342099fb

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 03366428542614250638065. Exactly this sequence comes out of new Random(619).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 25 of Run 7 (seed 629,367,141): new Random(629367141), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 18:57–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs