A858DE45F56D9BC9 archive

201206291040 vsyiu

explained decrypted filler

seed 384

Metadata

Post ID
vsyiu
Title
201206291040 → 2012-06-29 10:40 on A858's clock
Posted (UTC)
2012-06-29 17:38:50
Timezone
UTC−7 · title 10:40 against posted 17:38 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,104 hex characters · 552 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
17
Filler GUID seed
new Random(384).Next(9) ✓ verified
Run
Run 9 (seed 449,725,219) (seed)
Draw
32 · predicted N = 17 ✓
Machine boot
F 2012-05-15 19:12–19:12 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

C08C7462B5219142 420CC9A1A4C70B7E E05FA4D3DCB5117A 6052ABF61326BE26 ED23E8A91D0F6FDD 64A767BC6DD91CFE 381A23363332F848 369343096AF692AD 7208A08C4C5236A2 931A0EDB7E58CD56 FD126E0FB5C0DED4 7F5F2C52ED08B098 AE14449AB282918D 7B4E30792CF23836 467505B323ECDED0 F764E87D3E7ADA7E E8C932786CE2A010 1222B06D1254AFBE E3DA94A347F2D7D1 9CC9E126299CBF01 4FBD57D8E6301479 C7DF6124F765FF89 2535912AE176E9FF 8F33B19435248B06 6E8307ADA33B9FCF C6A667421E89C11C 9EB83EF72ED3A56E 1A92DE96C0878114 4E71B082B1FE60E3 D32C69CC090CD277 C6D435A09A3C8030 CBE061D0BB99AC27 6027DC15E0362B9A 4B77D2F92852BFF2 14D06C5EBA7FA566 6536300279BE1057 0691FC4DBA52947A 19E9504AD467A843 D6A5691F9621EB1E 4988FC4CEAB3F6EC 1377D3D3D5218FFA 152963C7190485DE A1520E85E802941E 2C06C9BD17E8BC15 28F78A548B6DAC6D 2E1D817BCA7A810A 538B899B60423CA0 3824F84904B3ED59 7E8D94325846282F 525AB81423E421A6 7E0C956BA81743C3 A7E8801FB7D07146 258702010FBF673B C4CFE02AF0A774DD 2C0AE64CAE349C48 3E322A077660FD6B 3392E6C89D791CB1 059D1D5B98DFF4F1 C308D1489E335762 2F6F9F72213AFD62 94BDD07FB3157F94 7080352AEA320900 2B91BCE2B40A3E92 A979BBDE81A8F1D8 B82628473CFEA753 9D756D61D82E87AC FB80250686A15DC7 AD979525254D0641 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 67adc47e-310f-3d8b-ba67-7fee30c35b28
  2 a27a51d4-65ea-4257-b504-c8e9f3883b00
  3 97aecaea-5d5d-1d96-819f-a8ab718f55c5
  4 d8798959-2b20-4435-b4eb-740a512fe1fc
  5 9aa8917c-f98f-5f5a-bd87-26dc88e97f25
  6 c5d03420-7d4c-1569-9887-aed5e5440cb7
  7 87a30e02-03cc-8ea2-b106-b8d748782c38
  8 37759420-4b85-005f-b0a1-caa8f24b136a
  9 318a34d5-e584-4989-a12a-093d5014d966
 10 9fe311e8-801c-7108-8a71-1b7b06f81b63
 11 bf24b2af-d116-11a2-9884-eba0da5fe4ed
 12 e26b09a4-5e21-2960-bbfb-fceccfd817d2
 13 6fef2b5b-fdfc-5089-adbf-497315aef798
 14 676acd44-8c9d-2545-8bac-28e7e80febe4
 15 41b45ff8-d8e6-68ac-8d70-6e70e89a07e0
 16 d8481717-8f1a-7379-9594-b822bf3ea650
 17 5c1c5152-3266-217f-9996-17937f08f4fe

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 34145180471252672. Exactly this sequence comes out of new Random(384).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 32 of Run 9 (seed 449,725,219): new Random(449725219), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:12–19:12).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs