A858DE45F56D9BC9 archive

201206272113 vpsnt

explained decrypted filler

seed 524

Metadata

Post ID
vpsnt
Title
201206272113 → 2012-06-27 21:13 on A858's clock
Posted (UTC)
2012-06-28 01:11:45
Timezone
UTC−4 · title 21:13 against posted 01:11 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,104 hex characters · 552 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
17
Filler GUID seed
new Random(524).Next(9) ✓ verified
Run
vpao3 (short)
Draw
6 (assumed: numbered from the first post)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
12 · 6
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: short

From the post to its content

As posted (encrypted)

4BD1A71697F767A2 B3A8BC6C6C2A1A75 7ED350174CA49655 B9DE91DD6D16E4CA 108583AE8295F16E 13362F456C654360 CDA615916DCE4B5D F0D550FB0CCC8528 2E0181C4B00F5F9C 3948EBC17DF4D0F6 E9A3AA830B166EAF AE9A7B86FF3E63DA E4DA437D6FD01CCA 8A70F14BDEFE18EA BE97B6713B95F8EA F728501C91425140 FCD0C108C385F9E8 7DFC9B38F623C8B8 E20BBF9D6325B0C9 B21D1E87ADFD335F B31FBA365D01FE97 7CE8C30EBC70DD7F 56EF38F1DA06802D 726C3A41DF097CAF 8BBFE6D252AEEA06 DFA99B63B34B1B87 709AA8FD0578F8A3 7B677EA7E20064ED EA6A17C8AF5CB463 5123AC714487D729 AC7EE29825EA11E0 5B4F42EB41FB4E49 8C5E7F657C615639 F2AABDF28C32069B 1EB1A5056D0EE2D6 F0ED91F8579B5E0E C8F9FB767F94BF92 06D4E8F9C274CDAA 49B020AB57FC5EAC 049B588A8EB079DE D9254414C296E75E 708E3D31B65BFD5C 7F83DC0C93F62AAC 5F631CC64D6F34CF 2916369CCDA25F18 E4A5C2CDFFDA29AE 88D5092CD1C5A6A3 1280C1A5AAB90991 839312F5B9C4BEA4 0CB3FC3408767F17 2FB50D3CF7D07352 8C72145267C1327E 1229348D58C7DA2A B68A1D9F4B1FCD57 91A297FCEABA4D16 BB24F7DEDB2DC624 D1569C94E83F4E15 F00FE855A4542695 92601E088EA7308F A0EF46232C2DBA81 8C259D093A00626C 35E8A75830764F05 C94BE825EE2774E0 A2FA551F908E10B5 BAD9F2B20E5CDF80 993FD8643D38BB94 6AEBF36D256A8622 9C4731D8F6C5A33D 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fdca1b84-8bb5-4094-9cb4-55036915e177
  2 ae87684e-4730-5e77-acb4-5387dd1f96d2
  3 c402a6d5-d621-07d8-a8e5-267da07dba22
  4 68f889b3-cc19-34c5-88fe-acdf4b7d4f33
  5 bf0d59f8-16e9-7f1e-914c-f32178c845f0
  6 c0ffee87-c773-4f48-a71d-abada795fcdb
  7 61e0168c-d6fd-6495-986a-344080bf05f4
  8 01bb90c2-e054-27c5-9164-f2b807f07b5e
  9 4e2bdefe-8b57-7dcf-8f86-58d1989f7c61
 10 26213ce7-8436-40e9-8aa1-e96e95200b9e
 11 8a6e6a1a-df88-38a7-8c47-26897fe3ff50
 12 afdee21a-04ad-582f-8564-1f2925798ad5
 13 a2e3db2e-e406-7273-8a03-0f2a0366f417
 14 b9a58358-1c72-0333-911a-4af6d799efe2
 15 e69a9367-d7e7-6b7e-8e6e-d3562e2d1625
 16 d0a5695d-9122-2485-82b1-43aee46ba2bd
 17 09c2b698-4cfd-1c8f-a58e-ecf652c5d7d1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 45037462743570621. Exactly this sequence comes out of new Random(524).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in vpao3: 7 posts (40 bits) with no seed under any tested model: not Next(8,64) anywhere in 2^31, not run 8 with a new range, no fresh start on either June boot, N not from the GUID-list seed
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs