A858DE45F56D9BC9 archive

201207040536 w0x7s

explained decrypted filler

seed 703

Metadata

Post ID
w0x7s
Title
201207040536 → 2012-07-04 05:36 on A858's clock
Posted (UTC)
2012-07-04 09:34:11
Timezone
UTC−4 · title 05:36 against posted 09:34 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
912 hex characters · 456 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
14
Filler GUID seed
new Random(703).Next(9) ✓ verified
Run
Run 10 (seed 38,548,093) (seed)
Draw
36 · predicted N = 14 ✓
Machine boot
2012-07-02 09:51–10:51 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

72C24E51F5A70F0E 45C651AC8B6BC758 1412FD149D513695 6396B0A12933D3A7 1F6F1F96DD93BB6D 72E0F60F6AB135B2 1D8F40DD91C4367D 48B86C64C4B897C3 12C05EE9F4BAC4D1 EE507DC19F4DD61C DE66ED95CEC74388 0BF500AA29A42D93 21B0058A6D30C7B7 A52187B52D6C3FF4 770F390624739F46 6A2E3D9DB2A5DA7E 4ED39CEBCC5DB9CD 48E113D38F95D416 0A6FEFA3F9CAA107 2F95E3C4F419E118 13FC3F21CB350479 8AA988687F832800 F69ED0B7E78B12A3 23515282996DACA7 EEA253AE01940E67 2077F272E1743235 0F597F4E574C8741 7E48F8C04A578714 0CE9F67E81CC9F79 56C7E4A5D2D9B0E0 CF5F16DB71988B6F A6DFE5EBF9EC4582 123172AF3B9B65B1 3F9A21CBEFCC75A6 BE372016D6056339 78F8906B94406929 04EF320A7F993146 0A7E80C55301717E D0D896E6F0B6DEAC FEA24167F62521F4 4B7165F28A19A56A 86686CD5911314FF 8E922C68E836DEAA 00D34F346E93483D 0D8DD76D6BB2C701 196CF50DA719BD60 AAC374D327E794E0 E2F5E203AE7B9581 325358C62DE3DB58 7CA292155AA32FE0 0A2845E894B9F963 EC34455E197EFE69 C6442C503D156C97 F1400AB4E25E3ACD 06D073334FEA0FEA 20834F7DF08D486A 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9f3add45-9678-89b2-b936-42f0a2666680
  2 1a1bad46-6964-0565-9cee-dd04cce30748
  3 30bf40fd-f482-1d26-b275-bf4b25529836
  4 07e4a651-069a-515b-8f2d-a89ec2ca7f70
  5 9a72e22a-5004-5b27-9380-a88f91607d8b
  6 524047d8-b656-8fcf-893e-5d590cbad095
  7 5e1d4ec8-eba1-82e2-b761-3417df256a0b
  8 db7abba9-b6f8-1c69-94f8-0456f2e0bbbd
  9 06ac830f-c1ab-8789-8a9f-f5922c61ca50
 10 a57a04d8-518c-4a13-9adf-1988e8e78666
 11 625d24f1-1ac8-1e92-8685-8accd63c1072
 12 d6929b8c-bb9e-2c57-bef8-6bd648000fd1
 13 20dab109-91fd-8c75-ac97-d211bd16383c
 14 4ef9e197-6e0a-1594-9ce6-90d83323dd7e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 80155881841281. Exactly this sequence comes out of new Random(703).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 36 of Run 10 (seed 38,548,093): new Random(38548093), Next(8,64) per post. The RNG predicts N = 14; the post has N = 14 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-02 09:51–10:51).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs