A858DE45F56D9BC9 archive

201207032235 w0g2k

explained decrypted filler

seed 375

Metadata

Post ID
w0g2k
Title
201207032235 → 2012-07-03 22:35 on A858's clock
Posted (UTC)
2012-07-04 02:34:05
Timezone
UTC−4 · title 22:35 against posted 02:34 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,256 hex characters · 1,128 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
35
Filler GUID seed
new Random(375).Next(9) ✓ verified
Run
Run 10 (seed 38,548,093) (seed)
Draw
29 · predicted N = 35 ✓
Machine boot
2012-07-02 09:51–10:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

478F8B8E3249823F 22DFDEC3121764A3 2BF424F4F33E6AD1 2055599919CAC71B A2917B70E88F3280 0EFE05EB58771C41 557E73777880976E D03CD22A30EBE3B8 9D0AED3C052F5B61 13A56A500BE8DE4B B24BEA7C2C635495 31F1ED145541FC15 4612D46DB7CCA287 C1750BECE5A4B7E7 B9D999093AB06EA1 680BE7B469B86BA2 3C719AEB85C7F069 C15691B0C782A60A F23A22619AAD9E73 0E6B115281094EE1 6FC6CB916C07774F E371D7DC99A63491 B730A96AFF082AF2 AD4C7FDFD6507B7C E4928AA55D138A8E 2BFA307D93C818C2 747B5685E3224DB2 4A5AC62B5D4B9309 C8B415A3F7A3F588 635787BB9D1D73D8 42E1434065EA5AF3 0F4AF4B0086836D8 96734D03174A7D6E 5E791F3EDA6F0763 A19B9CB4BDE75EA1 FAED80E9D91F08B7 83FBB9C5B412E15B 7C8D18F95B0119F3 A0196D3282E9026D E32B973EFB7808A9 670B88B280065EE8 F2B874E9CD100CC8 D47CA7362B2A6C3A 69676FB04D25A39C 6934D3CB14E2CA56 C5A6E45277A7E292 E4B089A0AA1AAEE6 C25665FBB809279F F063A144B8076444 7F515BDA02FC0DF8 6368FAD9045DF63A 7EDA2D99208C2B81 A790CBCA16305A1D 1AD6DC033944DD79 C92655E6977AE879 AB864674C67D5C6D 0FC3D10E1C4249ED 08E102F1F01C46DA 8CD67F666A06F6C4 8B164EF6F3B149FC DAA34D406B9EB6B6 7416EDAAF083C7E5 FD796E014365085E 9F70FDA0BD616166 73BC0F6747C72991 C03E3F4BC63EA6B4 990CCC202BCA6750 6FB2170E17D37B29 A7109E98A50065EF D52CCFEA2BA2D38B 17006A0827FF0B32 E96DA0AF15940385 D55358BB43435188 D419386297DA5BD0 6947BDFF48D9F6AB B9B248D6A88EF67D 29BFAB53E69FC51D A0214247634E55A8 C18112F37B703487 F28999E40A854B21 E0B89B2301860051 8D2EBDE488ECFDEE F7E353A518985C77 6D9309AE6AA4AD0E DD0469C2D53A40AF 1B8D78A0357D72EA 775A779A28A65348 EF09C0E793AEC02E AA1456C3143F6B47 E74994A4F60D4B68 27636290DC33D5EB 0072E220DE54D4BB C4F38D49C538CC64 9C0F2B94D18FFE9E 79394E74C84AB0EA F9967778BA0F3B26 8B4992D2FA9E81CB 4C931466DFAECFE1 71CC573E20D169B7 88B04DCE413E6881 E722A7723E413697 CDF6376EF5D2E5C2 E5B531984202A836 D1D2653D10F67324 32DBE469E4EAD991 596E11DB23957C17 E4AE44213AAA93AA 8B444E99C6370BED C7D4C0CCDDF81132 15202D0313A40ACB 1B8A3F6389167DE9 4B8FBEE10983771E 5120292A7E8141E7 36558E5DFB455DE9 87D5974E916B85C3 674E9B8FD8177B55 102FCF770BFFAE57 65BBD3B3A520E7C1 FFD1A6F57FC6DE86 5B0E370C8F1EEE0F 2D643C0FC6422619 CBA8C07D6027EE92 B9DC5C278A03AE13 5A9F53629FC648CD B958200262857C79 69F5B2F78A79935C A07614BFA9B649F0 62E3869320D1B8E9 42E8EB6B434D9FE0 BEAF5AF1E2C0517A 891D59631D8AEBDC 543049F3D1D3AC39 38054586E5625E92 8BC989EB9CA92B89 E6BAAEC322C52B61 56A9088CFB92AFEF 2CCFD9D31B5CDDC0 B48CB36817C586C8 0C6B5F2C51EEE689 0D63B02D05C0B625 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,256 hex characters = 1,128 bytes = 141 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 35 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a8ecdb41-3ded-5161-bd5c-6bc363b03f87
  2 e32abf18-b73b-71df-8f8f-956cfe2f0758
  3 b55df4de-004b-7bc8-a12b-a2829065e27e
  4 fdbb0f14-6291-5864-8f0c-1b004fa11c3e
  5 f184685b-0637-4738-ab83-b4738b276b3e
  6 062c11ad-a071-290d-a796-8725f0677cd5
  7 eaa85e4d-d793-8f12-ac01-3ead5cfe69bd
  8 cad50774-2d2d-52f9-a29a-e46215f8fb60
  9 d67a3ef5-ecb8-31ba-aa6d-ca5af42d7abc
 10 0400934a-026a-4f20-9c05-64ccfee1d55a
 11 077f61e5-9b20-51ba-a9f0-0776dcc90f2d
 12 ff3ffeda-b297-2aca-85e4-4973391c9fa9
 13 7ec9e032-3129-39c0-99b0-7cc0d9fe03ea
 14 e12584c9-4d68-581d-a124-2cd6e8246d92
 15 7942d996-7b60-48ba-b60b-0fcdfb1d44c9
 16 73e39b84-e9d0-2a3b-9a88-5d6886980247
 17 5537c838-d32e-4ee2-aa88-6b64694ff61f
 18 55a7db85-3360-4e75-9823-e362aea882b1
 19 bbb1a44e-f4f7-709d-a04d-2c772dc82d93
 20 3a38e819-8e38-4fef-a7f0-9d2527c5381f
 21 56ff1b93-3eb1-5a3b-a31d-f1d6e284ebcd
 22 69bccefb-baeb-705b-a5e1-18e0c906b98c
 23 0342d607-14a0-3739-96e0-6164bacc5740
 24 d8218bd3-c0ac-0d61-b74f-fa5b8b856ad7
 25 86b06cbf-f77e-41a7-afd7-94d95976e63c
 26 94bf617d-1158-6fc6-a6cd-134a870bd505
 27 81c6f574-767a-34b7-b9fc-131487ce65b3
 28 97221887-037e-0e95-b3d4-59391d96a36a
 29 da60e655-e262-1d71-963f-eff51d3fabce
 30 549584a4-c1b8-0dd9-bbbe-56f4edc70044
 31 e018b197-d4a4-5040-a087-5db1228868ab
 32 edd288d9-7d77-2cba-a3af-c8cd941e078a
 33 8d57b40d-4332-06af-ac27-b933d8f13c0a
 34 a7738fc3-5ae3-304a-8dc9-e6eb41160622
 35 a5a1c5b0-7457-58dc-b7a0-2b9e95fe399e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 57754285345235424474573046301052035. Exactly this sequence comes out of new Random(375).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 29 of Run 10 (seed 38,548,093): new Random(38548093), Next(8,64) per post. The RNG predicts N = 35; the post has N = 35 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-02 09:51–10:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs