A858DE45F56D9BC9 archive

201206290023 vsb44

explained decrypted filler

3DES(name) ECB, 39 GUIDs, seed 187

Metadata

Post ID
vsb44
Title
201206290023 → 2012-06-29 00:23 on A858's clock
Posted (UTC)
2012-06-29 07:22:00
Timezone
UTC−7 · title 00:23 against posted 07:22 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,512 hex characters · 1,256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
39
Filler GUID seed
new Random(187).Next(9) ✓ verified
Run
vsb-burst (short)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: namerun: short

From the post to its content

As posted (encrypted)

94F18585C277A870 84B41E43BEEB96F5 76F3873DD3DEC624 29B6B573888FB1EB 4DC8B72791B0709D E97E6A030551A825 0E251AE0A45BC98E 957AB774BE9FB351 0257EDAC347DADB9 0F21804F319B1E90 25B7A88EA637FEBB 310E4D1787524BD2 7BD6D15040ABB10A 6CFF149E2244A210 0CE00612E11903A9 0FC4DE3709E5779C F90E9757C21AC3CA 0B37128CE9AA44BE BFA5843F35191B73 B2EB455D23E90E55 DF2DC5CD46D73C91 F8772675C7BD5A91 8956958AD6F1536E 8616700C209A33BD 71B39AE2C9FBEF95 971256A8983CF6D5 551EA7C327FEB504 CC7DC7F5A6BEFF75 C4903B666021B313 66E060B35E28970D 22CCF1D70835F508 77FE04062B0C99B1 F024CD752ABDC4FF 55D8B13DBE5ACDC0 2BA3E21814F86EBC 32DE646C8E60414B 20797E1BA0202F07 785A08F84742B8BF FE998DD707DC1682 6524EBEB7546E216 3797C54A915B8816 0F0617485483C678 2E0EBE511860B3A5 01A41B8FAB30EB86 E7E4DE439130C501 AB1DDAD17F298B42 CA82614CADC8A172 90242BDCB647FE8F 7082F4285539B1FA F2D8E4A763FE8673 25D4F3AE9B4292BB C2338BB352BAB21C FE73946E72C1A2CE 0D22A1591D2A5F0B D22A39F5F3E867F5 FF053A605E17439C 9802AF3B2FC318C4 AAEC2FD59AE02911 A0C1EA833D4C788C C26984BFDDD6F34D 12B48248A6AA8937 80824FFF3B3D359A CBDCE5884BDCC754 16853B4E1304660D 39237DB4A285D6F4 ABEE332C27A2DDD0 D00242D821A4F395 FBCC148BBCB3D77D 3759EEA9FAAC2E16 2249FFA9DB754F70 4D7AB7151BF2BFBC 9EF86D049E9B1AE3 216A37FA1CE7C845 253769383F603F7C 2BD1A06F4D6BCEFA 5E638F62BFB17846 406AC38357B170D1 FD4771018FA8452E B17370C851BCC96D 2776CF34A650A459 14DC1BAE6BDB20F0 1628CB2269F1E4A3 A68D126C964F7D63 7841D2F1EF4A9F22 78D166749E873E9A BB3FF04681362C19 2E66849DCA8B0CE3 AE245768AA70752A 5C04945FFE750F60 23B51D1A6B11A7B1 1E92872F2D44DC7E D0E78C12CE5482FD 616D7CFF72B7D689 8DE112BDF28373EF 3BC363FAA12C3779 6F2DA1B1A9FC9B9A AB6CD54B844988C6 DA6D8CACF4763ACD B15E7C5A8811793C BD5B33B50F04CE8B 0FC757A086654321 246466FEF0756A85 8ED7DF3FD4D8A74A A23524140E3CE9F8 4EBD7601AD99825F 78EB471E29FF5B90 5F1657B401542F8D 4824E1BBC555A08F 95DBFFC24A00329C AFE22AF4D8B8753D 6700CE73AC6A7D2B A4B4910DC1ABE33E F651AF79C7F1D83C 6B83FE47F0050037 F3E6E2F140D46CA2 C3CE93DAE80C3E44 06C827CC5899982A B0E321D4F89E1F03 4F56EE772D027447 997E4190A0883B4F 09650223C268B75B C8E6E30A39D9A052 BC6CEAD5F1BCCF33 6D64B28D0E99A1CB 7D8E2960C30C1B3B 3DB3336619954FC5 F9489A307C2AAB69 59AC6710428E522C 98C77519739A08C2 86C8CCC177B425C5 E748F6F1C6C06875 7E6231AEA3E2AF68 334D23D2DF777314 865273ED1056A516 73F77B4FE0FB8DD0 3C5C2C06956045FE ABF848B844CDBD26 CA7AA2C28EFF60DE 75351EF7768FD54E 633FCD27C431862F 6E13798AD7D0176A 6A110EE82360E177 44F7813E8070F145 56C2614BD4BF6F11 29A6D2D97A64D449 D1DB981616BF62E3 6FB70C0D3D4EF4C1 5105D05EAB7CFA35 C252530725266238 34DD267326C5BEDC 0C364BBA5CC09A0C 93DF9C681334838F 4ECF37F94C91CE1C 11691DC0FF07B33E BB06AF8516D08B92 07DBB7AFD8A793B4 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9e036b0a-0c3c-3185-bc5b-c2c4998cbdf4
  2 d0706458-9bab-65eb-95cd-165ac4b94bae
  3 79fdc523-b90f-460a-ae0b-9f736aed8fb2
  4 8f332b21-73d5-4d50-87e7-a3bde209ae6a
  5 35b6a3ef-c4b1-55f1-bb76-19bc7b3801d4
  6 fc751df5-004e-83e5-a124-a5bce82d351f
  7 20dc5f9e-704a-6369-8e8c-4e033a002a1c
  8 cc4fe341-7f61-205e-8481-c1c842989d3d
  9 51a71ab6-65cd-14de-9e95-8995b497db1c
 10 6661bed6-edac-2487-8c4c-9c9038b4fa69
 11 765adb63-3308-0181-be0e-94b3831205fa
 12 ae3f3c0c-4715-45e7-8833-beae89efcf92
 13 3ec02420-3e2d-11c7-9b0f-0da0752efc85
 14 be301392-f66c-62cd-8c72-9301702213e1
 15 46096965-ab41-7d12-a0c9-d73efd8ec356
 16 e8e6a778-b88e-7cce-ad51-2b20b3ca3d85
 17 9ae1a917-7604-4251-8756-23b4d75abbdd
 18 b13ad606-54b3-839c-9ec7-1344354de3dc
 19 6d9f4525-dac7-6e10-954b-7d881e5b198d
 20 c0c614be-1ab6-6049-a2a5-b4ca90bd9263
 21 6d29d4f2-b941-53be-9b19-bdcae746cd8c
 22 94a68509-4383-6065-a1ae-d4cbee4c5b0b
 23 671524c1-32a4-5024-8f0b-ed94f22005b1
 24 a08ba8bd-4859-342f-8bb8-1a733d6599bc
 25 ece70c3f-18d8-08d1-bf15-d7c8430b9ed7
 26 44d0d90c-625b-79b7-871d-9bc608adca75
 27 2c106a5b-57b8-6b22-a51d-04aa309b5b6e
 28 82839e50-1717-4a91-81d2-31de35cb81e4
 29 5f458148-15a6-1437-9da3-98cfb84d0036
 30 df8902a4-821b-6f2c-9489-04872e4acf12
 31 071752ed-164e-298f-97e9-a899d1c9e94d
 32 0d65441d-9146-6f50-8372-f62d3c44725c
 33 97d3d005-3b2a-4d52-998f-55bbc402ecfe
 34 e6b3dbf8-46ee-6576-9d8e-5f35610c936f
 35 9ebd6783-026c-84aa-a79f-8d0b382687b0
 36 70ba59d9-e5de-7fad-adad-97d5c435610e
 37 5ffab086-59a6-83a1-b134-ccbbf92228e8
 38 daed8e85-bb3d-7c5b-98a5-24420d034aa8
 39 532fd5e6-46b2-3dd5-8eca-9f8867041399

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 364458621204167748665653076416264687873. Exactly this sequence comes out of new Random(187).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in vsb-burst: 3 posts inside the run-9 burst (07:19-07:23) not in its stream; a second instance in the burst, too short
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results