A858DE45F56D9BC9 archive

201207040136 w0ovl

explained decrypted filler

seed 984

Metadata

Post ID
w0ovl
Title
201207040136 → 2012-07-04 01:36 on A858's clock
Posted (UTC)
2012-07-04 05:34:08
Timezone
UTC−4 · title 01:36 against posted 05:34 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,744 hex characters · 872 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
27
Filler GUID seed
new Random(984).Next(9) ✓ verified
Run
Run 10 (seed 38,548,093) (seed)
Draw
32 · predicted N = 27 ✓
Machine boot
2012-07-02 09:51–10:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

E061BCD0B980AD51 661AF8532EB6757F 422EA6564F6525CD C52125923EEA5864 D97F48766AC6959E BA4F1535049577C9 14701C86AB652C39 9A814485EA449F04 1D2B8872017444A5 8000428073A78E17 67617083E6FBC7A6 7521FFB52CD50C34 BD40A96F411DA27C 56ADFDDA4804A241 B1C1E569A4135CC3 9DBA545744588C7C 7626A01621E772B5 FAF48CECBC8402CA 1C82A14698D66941 3B667D720F162CA9 42B0C8C3D6D95EFD 89DA257AC5FEBC00 B528A151F9257E2E 14AB42070F58E3C5 0912F55DFDCC5409 FD538E1C2CB73FA7 28BFD62D15843112 E46C1F2350C34324 97BBCACCE8FC674F 1AAEF4C9EA09BE73 A8636F6396E37250 0ED9818F9BE151A8 388685770A614FF5 303B17054280BE1D D7AD41DA5D51C76F 634F1BEC251B8915 E5F7E9A9C01CEFA3 804F9F31598B7CE8 38139F956D0FCE7C 2A0148C415B14BC2 6013638B076C957B 6E2DB288CEFC96F6 24A7E6A8B144BD7A 0645575CCB501734 03D18901EB0DB619 D10B239D3E35BA63 505F5BDA8844E156 2FA65C1E50642598 E689F481712FAC53 5942971CAA7FD2A8 14D24C4FF26FA3B3 3A788C08B29CB89E D5024A922C8F34EA 3A23A274C062DEBD 99164260FA9C6E8C 7C8CDDB3A9752C01 6EBB6422C8DCED1B 9E6AAE337421E628 E629FF7A7A17688B 714F059C82AA9EE0 B8FFA96430ACBA87 EFF217523C754982 C30CA4D3ED3C0B8B E0D1ADF5170DD482 77E06B0EFBE40FFE 91D0746E84E33DF8 54C3542C4D4A36A0 CFC05821CA28EE7F 75E263248A2D5C5D EEB1D3AC383AF4BF D18E21995413B8E0 42342EBCE45A57BA C6314627729F1C42 CE1D85AD09B92DBC 1E8BC88D942F8A7B 90E2FF8996774F30 541E74622F4738B2 179E9E820FF437C4 06B3D4A8A4AABEFC 7A3E7DEB326AD1DF 12FFBEAA497C2BC0 1F03615C06C24260 8F097E95D1900B70 614E5F6E7C094D49 6386547F59B2F21B E18794C0BE76CFA4 FA1F419BBF256BEF FA9EAEC1B5743811 C158215952B40BB5 6DF99DE1AC4DDFEE 9CBA5CC851A9B100 99F981E4CC8C0E67 3E6195722B2FEE62 DE35536B2BA17C84 E0729783DCC0A682 65394AF5CFB050A7 CBF8D6DBB5C59594 FA4BC7F51FC3A30E 0BEE3CAE09F95C18 7B8832F6B547DECF 2133A429B20B281F 5BD7A3C80616AB0F DA326CC0BDE800C0 34A30FE19C22482C 5D2DA1745F7BB0E8 3953EF8C9F04F892 3D58AE9BA2B2AD75 0C32ACA155A66107 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,744 hex characters = 872 bytes = 109 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 27 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b78e02b2-1310-7320-ac55-e827e5a6e3e9
  2 b759d470-0ad2-4ac0-9603-be30632989f2
  3 7714d7c1-31c5-5e14-8120-df0b510bafb7
  4 cd0309a9-2f7e-57c1-8f4e-0cb1659a6e66
  5 fba09f69-5001-4219-a4fe-c7ca48badadd
  6 f4d0350e-420f-45a8-99c8-9a63433df21d
  7 d0713ac0-dc34-7f56-a64c-a38d5f33dfca
  8 e9aba38e-c081-0374-8618-72efbff7fc3b
  9 c42ce679-65c6-61a4-842e-87ae298c92b7
 10 3ae4c4ee-dacc-1315-9e7f-f1cd35018fb3
 11 e3a1422d-69be-2e49-ba1b-2f65f4a98096
 12 266b5618-4e30-6840-ba96-206df8856105
 13 8ad88e79-ee6d-0524-a7b5-94002f4887fa
 14 ed7bc4fe-2fc2-347e-84f9-4d4b9075a304
 15 e579bcc1-1cf2-62d3-b166-988a9a9e22a8
 16 23e81f84-e55c-5ddf-8237-cc7232b52317
 17 f6b75042-3f81-460b-a229-7bd1ba6f0658
 18 5683cac7-d248-06e0-ad8b-73b2cf71b4ed
 19 7da9cb91-6605-287c-b974-83acc1f43e8a
 20 9dfedf5e-5623-2417-952c-602455a04a33
 21 e6af1f79-0ae2-5e97-8b54-5306f78a102e
 22 5999d56f-c98d-254e-a980-bf8870b7471c
 23 6de4a2a6-c9ff-242b-8acb-eafde2b1dd78
 24 68823452-da08-7e92-8661-590623628fd7
 25 4d65adb5-dc65-1c51-a5cf-fb59fc5ca0a3
 26 e1dd0bf4-cdf9-3e25-b3a3-cd98102bb41f
 27 29a5d21a-eead-8ddf-8a85-4ec526871468

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 745544706126036540225227138. Exactly this sequence comes out of new Random(984).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 32 of Run 10 (seed 38,548,093): new Random(38548093), Next(8,64) per post. The RNG predicts N = 27; the post has N = 27 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-02 09:51–10:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs