A858DE45F56D9BC9 archive

201207061335 w44oy

explained decrypted filler

seed 938

Metadata

Post ID
w44oy
Title
201207061335 → 2012-07-06 13:35 on A858's clock
Posted (UTC)
2012-07-06 04:34:00
Timezone
UTC+9 · title 13:35 against posted 04:34 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
25
Filler GUID seed
new Random(938).Next(9) ✓ verified
Run
Run 11 (seed 37,057,156) (seed)
Draw
15 · predicted N = 25 ✓
Machine boot
2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

A8AF06E252F89382 CFF824E1BE3A058E DA36DDAE4B9163C6 A423085C2D880E78 A30DBBC3C6130AD3 6234B28213A960A9 76A28F057DE5B94F 0F24D1AB285D798B A92C30111407D067 5B13B37FA2C72F2D 2C7BA827C1D984E7 B7AA45DDC3BCF3BC 058611F6EC67AC39 61FD66B195622200 91BBFE25125A2AA6 B5DCBD84E2D93AFE 31B29E725CC3465A 156923DEF1121902 C056FF83CD480F74 A97E1E12516ED3DD 965EA3CEEE328E74 1879CAE8F0280CFA C071A06FDE202117 B247070D0A1A5842 BF0B80DB5E3CBC4C 225DD1AD2216D3E5 3350E890D7E84BFB 8863AE6688D2938E 8111F7E9192889A7 A12CE9A2D6F8906E DDE56C64008E4061 C1273AE9310F18A3 ABC76FA26FCFC20A B47ADEC080EE3EEF 0E1C4E27DCE61D1C A3C19D84EF7E5D2D C44ED7800110740F 4A20FBDCF524AB0B 19E0AB45174101A0 35A5C679F1077BE6 6436B822C9A3CA4D 74995AF0DE428E6F 3AA1BAF98723AA7C CA09A0988B82DA6C 1A1DCC6246F7646E 1DF979278E8766D1 66B514D5C50E0100 E92C241E3D99CBB1 EE71A185CC7C3E1D 8446F03D84CDB2DF 588010871B93E969 9AF294D126A3D9AC 8F9680FDC0550D98 C407992E3F52F450 98AA3EECD4CBB126 A512958DB22A59E4 AE5C664C727CBADF DBA5F061A0B73141 19FC93C8D3AFA888 7B31CF20C57EC9B7 C0876C1A0718DB1D ECE72FBF681ADB1B D7173EA14C523767 6C857B110A0D0FD9 84CCE1980EFC1744 1197DF9B2CC7EAE4 13A704F321CB03D7 25C9EFB1430F2227 AB7C2B08496869C0 76BCC0F0BBACE6AB 29997407491A6427 9406AEBEC28821E3 0FBDEF2636653D83 F91ADE735E3C5DC5 5AA079322188A1C8 60DFDAF98249D0EA 26567B887B7C32F5 75989B4FA6526B2B E4B9C126CA945090 FA0B86255B99E346 8BDE61A7FDA2C9AB 460B504FA7C21479 6E30A38580B406A5 7C1690CDA52F13D4 7B4BCCD3CEE0E4FE 484E64B5CF33697B EE21FCF493593F54 3B91E07C240EA31D ECA9457F18701AAD 093291198BB80153 C3ECB76BD59395EF 135F9C6D986BDB66 EFEF8D404A252A1C 93EC023EE7A6AA86 8271D04B92F563AF 673D42BAB07A8627 CA7787284A169710 D7EC8A3A8DE33EBC 6B137C9942DCCA10 048334CC78AE86AA 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b7a0d701-5a0b-61c4-ba0b-64a51efb681a
  2 acafd6a0-bc92-0d79-abc1-d5f5d910c144
  3 b340abfe-75e6-31e1-83c2-853a13a8bc12
  4 c872a333-8d0a-68a4-b93f-4c2e92abdb02
  5 ea3f27c8-ce8f-665c-a95d-a35c10145f47
  6 443b23bd-7ebd-25ba-a5a3-de13148011f9
  7 995ec40e-1fda-1592-aa80-3a99cda87059
  8 e5118228-0aa5-0e20-b176-42434e7d0688
  9 bbe10953-5209-0a8e-8668-61daef83f6f5
 10 82ed1c90-ea12-1e66-9da0-54177700e6d3
 11 23ad0e99-d53e-3e37-a458-de433701f7a8
 12 f8e35158-81ec-6f4d-8fc7-5750332a3a26
 13 a803373d-5ae0-4048-8d08-f13dc76b67bb
 14 cd5bf280-8cb5-48ee-8e03-a24144fb145a
 15 4d7bf007-0842-5d35-85d8-0591aec40cb2
 16 735a4ab6-9f2a-7742-a0cf-5d1b8b272350
 17 12aa590b-0a49-16ce-8d41-fd8549177f3f
 18 42a78c2f-7841-4f3e-a524-313737a4afd3
 19 9ecb0d31-0d7e-00e0-a1f7-6570ebd1ff45
 20 d19a6aef-2854-43e4-9118-a691c1e6fc32
 21 a04a01cd-3b57-4e22-a73b-820d673e8c84
 22 db01d38d-c8aa-8b48-a52d-e6e6e1b6aea3
 23 489ff629-40d5-4bb4-a3f2-8b53058d079e
 24 f713fd2b-5a20-603f-ad0f-35b7ab619779
 25 14c4a60b-3fcc-52fd-b22b-1d4256db117f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6036621001364457140448465. Exactly this sequence comes out of new Random(938).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 15 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs