A858DE45F56D9BC9 archive

201206302251 vv2qe

explained decrypted filler

seed 940

Metadata

Post ID
vv2qe
Title
201206302251 → 2012-06-30 22:51 on A858's clock
Posted (UTC)
2012-07-01 02:49:34
Timezone
UTC−4 · title 22:51 against posted 02:49 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,512 hex characters · 1,256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
39
Filler GUID seed
new Random(940).Next(9) ✓ verified
Run
Probable run 1 (seed 293,378,646) (probable)
Draw
1 · predicted N = 39 ✓
Machine boot
F 2012-05-15 19:11–19:12 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: probable

From the post to its content

As posted (encrypted)

B2B56F7BC9B7995A AF19C9D813372934 CB14AD7D9D6FED8F 341C4D716CAA6951 2CFB403C610C387F AA5055469D725A1A AE826995C4187E4F C45796891BDFEFC8 E83DB8405C21C8B4 F80F1AE7AB2EDDBE A6E08462BF180F0B B047DE9B4A623996 59F30CA91589A616 99316D55E7A9FED3 20E06B3729815234 4AE075B51D345244 C3A13788061A4E32 06D0E687D4CE56DF 20EA5E41EE96D7C0 0F9853693437ADB6 D40A76F07BAEBB70 A2ADB6CFF084D0CA 87A8FB00B384A806 31445F4E7158B63A FAECB57630C246F9 16721DB3AB7EB441 38181410B48B168A 762C0E654FCA447D 8F38C0481E2E17A7 4B4FC3FE2901B092 80FEA7FA28FC7745 D95E73C75E081AC0 8F2B63558022E6C9 AC767F36D89B4A79 E62B223DE8AD13E8 B806E65299B9E4C7 537BD9101623BAC8 146F5B318CEF2DCA 6C1314309F2DC2E3 0E1C7AF13CD7F3B0 4637DEC0056AC15B 9E9DA218D9F82221 2601AB6B691479BB 98E6EB9CB8B7B704 3CFC0EF0635D2BC0 18DEDB77BD51FCD7 1287A9FBF8222E62 BD03F01AB09AF708 A4C7FE722006CEAF F8DA64A57F240B82 46F016CCEA30FDD5 E4A73E77BC123076 1383F90027801AC6 936CFC65E822C7E2 A16100F515749713 A9E01553693663DF B4291E2129092115 5189BE9F628232DF ACB1D83052F79640 7AFFDE418E56EA9A 11A595367965E889 F3DC5707C78229F0 3D725C61BC91D9F2 4D50A66E55D321A9 2878C0DED3AC17E0 7351136EC0109ECC 708CB2F4D148F1BE 4612DD02CF6A1B63 E02AAE04D2EA2F61 4813153BAD9457F9 30D6D544E0D8C64E D65367F35043123C DC85E0C082806F38 7594DB6033DF553C F3B0554FED377AD7 81A57B905410CD73 A7432F6C2E2AE7A4 5D896363FCBEC857 315348394C290402 FAFF6117938DE760 81A5B0B33427FCD7 F0ADA642C07A557F FE3130BE1E480C2B 95F025A808E43E58 99C160E43108160E 0A1A1AF75A6C96AD 8F339C9008D34129 2133D8B8ED6D4971 42657F34F6597CAA 6497146407DF1E4B 890F36BC660D8AFD BD315D027743D448 458FF699FCC48B7E F8DED93C5B95C9CA F3160D5A91543926 B9C84BC8EC2745FC 9FAFE264F0B570C7 10A2DEC77EE3BE57 217CBB6C86E84B8C 55B01435C768471F BDE86ADA99F7A9AD A8505243AC7E8D23 7FE50078C839D2FD D3BE54804D2229A6 A0FD1E755AF6BAAC 8CA519A51CB10732 F81B457FD43E3917 37B7DAA6C03CFD75 78C6F37F24CE1D6E 8190240E05DFA296 BFCB00D807DE7E84 14ABBD8690171A35 563DAEF48534CAAA 75BB7B0BC0138AF8 93C2AC7DE6029690 98A1000E3F55706B F7B0F36F7AA3507C 64BF4AB3A33356CC 9D3ADC5C22E2928B 0E1C303AC384B847 F4878249C9B240C2 492F7FA2B5801941 C80090A4D3247932 6604A500B9B13C53 42A74E0122C9A833 B01DA7EEB0D27F84 3BBACCF31846F97F 9297C817DE3E574A 50ECC6A98FA6DA98 2F3778D9473F4638 E0914A6C0D57ADD7 32EA2EF99D6166F8 155C5E04D1F47F3D 1FFE6E1680149923 5CDF9BE2C1B61036 DAF2AA36DA8C81F7 B30B1D8239DB894F 51CBED9592DBE6CC 1D8FB34A7CBC9F0E 721001C176B369C2 1AEEC28D9A2B4F85 6FC2C273F471A783 5C5547A168E7CF5E F46C249D82A28607 51C7207D2B97EACF 09ACFED5A0E0AC69 AF8B845137655F79 3A639F41DEB33E9B FF1340FAC60FD091 ECDCBFC0F424DA34 A92E3E8E9F687A57 DA2DE4E913E7C61B E804D6DC1A0F892A CBB4C4B57BD5C3E4 B496A0B8D92E1283 D6F48FB8B91A947F 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).

Decrypted: GUID list

  1 41f3630d-aa3f-7b26-ab00-d5f9f030b8ba
  2 95226017-48d2-5a63-90c9-746142eeb58c
  3 215f9fc7-1928-76c6-9df6-8590ba7d9ecd
  4 03620437-a3fc-160c-960a-2da6bcc6afdf
  5 582a8e63-9bf6-5340-b75a-d4ad1c7e962e
  6 32b0c21f-2f68-0341-8bb4-8cfac4458917
  7 ba7f11e3-93a1-093d-9d22-f76e23acee18
  8 5cf2d8cc-057f-005e-85b1-3f757863f33a
  9 e52b6074-1c4e-27e7-9afb-497a1b8ea825
 10 263afcc2-7065-88fd-bb0f-c99a365dbd64
 11 aeb2b6f6-4be4-75f8-8651-717664c5488e
 12 6a3e29ae-c5d0-3d17-90b3-910703dba12b
 13 edb399c4-6831-734e-9995-d95c78c8d675
 14 60d7d882-569a-49c4-abe8-a7bb73f01182
 15 e772db25-123a-89f5-aa3b-fb576a3f94de
 16 f6e22d90-d1e1-019b-8569-5f02bb034766
 17 fcb43810-0c3f-8829-85d0-a52dcd26ce3f
 18 8101b8a6-4b6e-7d14-abc4-a82851edebba
 19 8e865b21-7e2b-17a2-a1c8-c431e7c90619
 20 01f845a7-6827-2041-85a9-cdbe28635d33
 21 7f9e54b2-0e9b-6825-b835-745fdae10499
 22 5bd8cba2-2603-4b60-ac88-50d00e017c64
 23 1fc631e2-737f-731f-95a5-e14c3caa567b
 24 fe068cbd-c7d2-389f-8aeb-e674c8692fda
 25 6dfce5a2-dd22-7f3d-9dc2-29226e2eb756
 26 bdd1159a-6ef7-1344-80ec-5e16db47cf0f
 27 a7d3b877-b934-1cea-90f6-60a08bb29242
 28 8861b582-40ac-1b38-99ab-43ddcbdc7416
 29 f9e628ee-6ed0-1440-a64d-022e693e6df9
 30 14fa70d8-0c88-1599-a69a-2108acc8baa3
 31 07eb5f10-28ab-18f3-b0f7-cf1bebc78c8a
 32 ee8be7f9-0fdc-07c1-901d-9578c288490e
 33 ef68eeb0-3296-27f6-96dc-0079fe8a46d9
 34 52687b35-a82b-40ca-b779-34ffda83c594
 35 7b472ccd-e4b1-7417-9c5c-b1a9974d2c43
 36 c0b65493-06d0-408b-8e93-0f55a5dba66d
 37 7ef7a8b7-e93b-6afc-9b78-ead8e1ccf2af
 38 e682134c-a30f-801f-a53b-412ef2b73bd8
 39 c37ea199-9098-2a74-8152-a58e1f77a669

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 757150002873748087126473711111102474682. Exactly this sequence comes out of new Random(940).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Probable run 1 (seed 293,378,646): new Random(293378646), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:11–19:12).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs