A858DE45F56D9BC9 archive

201207060735 w3krp

explained decrypted filler

seed 673

Metadata

Post ID
w3krp
Title
201207060735 → 2012-07-06 07:35 on A858's clock
Posted (UTC)
2012-07-05 22:33:47
Timezone
UTC+9 · title 07:35 against posted 22:33 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
37
Filler GUID seed
new Random(673).Next(9) ✓ verified
Run
Run 11 (seed 37,057,156) (seed)
Draw
3 · predicted N = 37 ✓
Machine boot
2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
12 · 17
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

A00602C6FF6EEA19 3C400C534866C1E9 B2112077C4FFAE04 092747C6D4F71F4D 91AC3BECA32C61EF 3BEE2D95A554893A 537CEB4B8EDF01EE 97D6CB605795A91B 470C4A7CDA3F05F1 DDD6973AA888C77B 698CA40AC667AC74 100D515DC0F06527 F878D2B174AA0B3A E2E775695702D44B 8322F8715C9722A7 CAAD6BD227D7BA13 018652FC29F3D9D9 169EB984297B3D40 5A11405E520E26A5 C5BA18A9EBFA3727 8B6227CABB0D4F42 C519B407EB3AB83F 67A2E23894818078 819DCB5C645D92EA C52826F5080B0A68 27D0729F44A48B99 963C985EF18AEE14 DF8DE6E3B76FD373 5EC59F126C8B6B02 93E68CA2E1F793BE A3618454C050C1AB CEC40C0FBBF7F72F D4EED0861287D0DA F0C72F5A63C1EC3E C884C84D7DBD655F 187FF490307767B7 E63DF987BE79568D 0CF3A6FFFB3185DC 301AF11FDBF8A238 39726729A8D5B8DC 5B3C74BC7F448B6A 3AEFEB25A9708792 918FF89F00FCDD81 3EB70958188A9C91 65402020A59691EB AEB6520781F46E2F 6255E2D107E99612 A450B98186A30A55 858CED9461FECB69 DB446AEFE1867AC8 58FFC44ADFD0302C F04A88D4DFDC9561 AA4E461360BA8E84 C8BC40D54A9EFE21 803749E7F765F338 BBFFBE680D44BBEA 8A640FB46AE092DA 52D910691DB297B2 27972BCB65921C9F 963562834DE5F04A C98C03AE8B93F33D E26A67BB6AE09D8B F4E3EC4A90FC269C FC406C6F25DC5530 27B05B69D92C3FFC C7395AD5295A7040 EE895E0F14462544 E250F9F5527A9A14 453E1CEC4AFDB602 69FFDEBDFD56A826 3E0ED25F2251DAA1 876591DE8AF0A091 54AEAD4519692EA1 1F48DF671069EB8B E2966C6D27758879 078A634C23CCB716 903FF48770FC3B5A 3BCE16DAF28BEB30 03F4945BA8DF0A55 EAAE46E1653F2502 BFA4AACA61E6B6B8 85F162926AAFD08A 48F4157C9A55E1AB 657C81D2AA629F20 EE40710E7D67AA59 0ACAB8D058B4DE87 E7C5F334D9306314 F7AA3B71BABFB189 63B4BFA769C145DE EABFBA06AE4B164F 6E474846BB746718 E6AC740AA8C988D0 87B36C8EFD703FFE 7A2F8DCAD68ECF6E 4A5706C74C35675C 7BE4B860F722B420 8E3D48E449EBA1C8 70C43D44F63DFA2C 4643FECBF11766E8 4EF046C646BDB00D 93889F186C2A0283 D37C479D17E7D981 CFF5566DCA085387 2A013ABE6A66BCEA C4CAAF1614D1E1D2 40ECE7F6238DE632 1401D125DB0ED671 5D250E40E2D3A59E 233876DD8DDE079E 343E35BBF4D8492E F037712F8418C95D DCB88E33C67F66D0 D41E9953E1C4AA3C 8831A1B0AE763BD4 A6D4DABD3725E50D BDE9C46D46DD8C8E 612A25E5A8718B37 E6749CCFB57531E8 08E320F756661E3F DE6F237BA3C420E9 2049C4A6BB193BF7 E0DADB46970493B8 273E0E57109E10FE 64FE38CBDC0B8CE4 BA2E7CD409432CE2 FCFF5278ADF6C807 C062545BC2519A7A FBF1077B2967EB34 16BEF4FA65C58D4E 2B6B0F70D5FDD87D F38EA06070022E32 FCB4E47575CB2C68 B47D9A48B3B83B43 592B1E67DB8BE041 6C2BE98828120CF4 F078863B92F35C8D 115CC445395C6131 8F65750455A16B38 99435D8D7B57E2E2 8BF87D2C6F662E01 B18AC92815F18A13 8018A171139AD65B F329CE7A65DCF7EC A435A9EDC364A58D 692969CBEF38FDE6 C8B591BADE5D50BB B5716739C34CFAFD 902481047B17E23E 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 00615c60-b441-2f49-b6a2-b0e7dca1cd16
  2 621f47a7-2702-2dcd-b9b9-70158e4e8098
  3 0743abca-9e63-16e2-ab51-0d0f296da269
  4 06ad80f3-dad3-15b6-a7b5-cc99f404825a
  5 6a240d44-3da9-0ccc-8e3d-b9e0e3025922
  6 9b516c08-cee2-6ce9-8993-51ff78eecf67
  7 ef0d285e-2e2a-4716-b56f-12e7912c9040
  8 3fa05f68-0a68-0175-afe0-dae06dabf4c6
  9 1c780ee7-d33d-2494-aea1-88424ca464a0
 10 cecc6e83-df65-39a2-bead-85af1043a288
 11 8ebf77f5-1743-1af4-9f0a-c0a7bf4bab7d
 12 b4f28e95-8f58-72b0-9a37-c816f5402b1c
 13 3ba5a704-f52d-2412-87c1-23d58c8debca
 14 fdf9a685-aae5-551b-a541-bc6131f3b550
 15 a559eb2d-ecfd-0f60-8d5c-96bf8a02b1b2
 16 4dbf8c7b-d299-2d88-9522-faf0ba6ef435
 17 1a6559e0-bc5c-638d-994e-67de4cd79438
 18 829d4400-2cb8-2e6a-a7b8-bb7d5578e228
 19 5ab1531f-e6dc-8db4-8b88-10fc972e615d
 20 b4239974-ed83-8754-95e6-85c2641c5fe4
 21 a72231fa-c94d-2d06-add1-2959f6b3f7b3
 22 0bd1f90e-ea64-87aa-96fb-b4a385fa6979
 23 08c3f1d4-4661-6275-9675-3c75f560efc2
 24 6982b1be-fbd8-10c6-b27a-138c103f59ad
 25 3c8c3b81-0f5b-5b96-80fc-0afe8cd804e3
 26 2bddf930-77ec-37c1-b5c4-940934cf5b3a
 27 c3672c01-c4ce-526f-8492-4b3592c55eb7
 28 4f089e63-8040-6dee-92f8-6bdff66900eb
 29 93710dd3-33a8-39a3-8f1e-696eafa26b9e
 30 857f93d0-2bdf-0fb3-8076-fb3eecd490db
 31 ccbc3ad4-9e12-5aab-acc3-77b92d16adf2
 32 1a7016f2-639a-68fb-85b8-1fccc70ff38b
 33 7f5eb89a-5aaf-822e-8d90-a8a7b5438f56
 34 65f217b0-e376-7978-9178-1d7dc4a1ec99
 35 72907249-2a82-5051-8d53-18036311c7e6
 36 1098430f-000a-8f99-b46d-9d89008197ce
 37 3454d856-2719-47fb-8fee-a144b811a6c1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2211064023172502628828615356305687584. Exactly this sequence comes out of new Random(673).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 3 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs