A858DE45F56D9BC9 archive

201207061505 w48v9

explained decrypted filler

seed 595

Metadata

Post ID
w48v9
Title
201207061505 → 2012-07-06 15:05 on A858's clock
Posted (UTC)
2012-07-06 06:04:00
Timezone
UTC+9 · title 15:05 against posted 06:04 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
36
Filler GUID seed
new Random(595).Next(9) ✓ verified
Run
Run 11 (seed 37,057,156) (seed)
Draw
16 · predicted N = 36 ✓
Machine boot
2012-07-05 09:16–10:46 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

00DD7981E9A2DF8A 67F3EF77C30E9790 3613ECDDF7568672 187CA50796E6FFE1 FA6C5CCC893B265A 33C13B7793E770BA 0E325EC2CC394E89 78726DD45BF36846 8C320D0711824147 030A8947D878CF09 18E9C212A41FDA7F 8D052A2BFF376918 34C445CFD96FE510 7C652316BF6B053D B8D30D5FFE10BA49 785DF610F6D33E2C B6DC584B902F9A43 A31531087483EC5B 52F05828FA699B7A 24997A337E12D290 A7D506D08003E88F 51A088896B719DB5 4773D12688782837 1C8C2D0552AC31EB 7D4D1EDF3C1AA463 149E67AAA2A80CB7 B47BFFDE4DBF2DB9 ED1B323D4CB4B8AA 2D4729B41E5745BB ED5B9E22CD7BB748 89015C2C346B8F37 B2F759470D803EA5 6DCD103DF7179EF5 C1672F3FF1C35C48 E3829D91BEED4206 10285E4C8480D3C5 499C456E8FC49410 DFD47D5F950D75CB A804DB82D2E1DC01 BCCC97BC31A793BF 1697F7AB913E2B7D 79356A7EEC69F990 5C581E07C92DD0A9 C31CCD4C1E22EB75 8FA8BD47AD3ABDE6 08170F839FAE1DAC EBA950F86C689944 EABC19A7CA56CA2E 1F7F0A42E08A839D 0814CED7820E445A 985C02A8F09FBFB2 6B77C0DDB76D0CEE CE69147DB40FDE4A FE430CE5026588EC 578871835F69ED5C 16B6B5C223C054BC E525B0468F996060 E1FC08F40D164263 C3C10DEDA67B202A 0B9B3F90D14C8928 2100A3B55CA11BD5 F8D569B8145FA8C0 8422C3D50EADCBD6 34603A8BF0578009 47C43299D9993AB3 810C379A15FF7E73 485388FEEEE3E635 B2578B7430C97AD5 2365BAB6F383364A 242F96E97C4C6C23 838797DF0C0EBB15 5BD7122A7BFBEC7B 9AC3AE309C29430A 2A3B813E35F33100 33D0B52ABB33ADCD 414F53168A284434 BCF49CB96EBF5C42 3CC950197C4BC1EC 8F5729FEFB7CF20B BB36E7A3EA06BE90 557FD22F80E6EE8D 5FAFF7F5AC7ECC7B 01A9C6D4F758A685 71D1C587925EAE26 CB38A7561DDD6FE5 97BC16297ADFB950 4C27D9952BC50B03 0DA5E96FF5E17DAB 56D547958BDB41A2 BDEE279AEAA1A871 88D80C7D313A898A FCDB5A278A9DED03 1420B5C16523D3EF 30DC89F7772530AA 2D236A30D188B9FA FB9DCCEB68557020 7F08A87A3E66599B 4D3F6192FADECADE ED8C2E0340AB95A5 AB811AA662ADBD6C 08BE47C3DAE02028 A07A169B7C7326EA 9E341419A6407C83 CA0177F28CF8A66D 51C5D7EC5F10F058 E3175840EE043DAE 0FC59E93E1D0732D DA3725BF0E0B91F0 13608812F6C64F18 8B72215B67FA6B1A 8CAC336F97C1B55A 53F39160DBE5CB9C 2C25D541C55E29DE 0520C2043CC98FAF C3ECE1F77F14B3D4 B40A53D3B2761122 1D38B3122C7955D5 E87935DD035ECCAB A5683C6E11D0585E AB824662AD6CB4EB 03EBADEE0818932F 631AC922B83C4D40 519F87DF20A5CF69 C0DDB7C3990AD285 D7F49410D820D0F6 19E9BCBB530D8F0E D8DC2B581DB7FD33 8FAFEA07343BB15F 221D26089A7AC1B5 DF211813CF67B9E4 243A0C63339DF2E2 46AD8479B5D206C4 17D64DBF681343B8 C2D8704E56266E2B 5B7CED5AAAC17EE2 998104D50DA78841 8FE85698A8463379 84099BEEA9C79DE9 E47A5ADC36537324 742FAB5E7DEC8A2D 13057D8CD09C76D3 67BC6FE0E23C2DE7 BB252B8C688787C0 64526548C9524E80 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 22ec4b17-242a-59c4-9db9-d8465f76227c
  2 86d8e5d9-a5bd-31a5-9a11-394c40fba62e
  3 994c47d0-33c3-542d-b992-412305e8f9ef
  4 58ab2f6a-aba8-5779-8c29-3e6ddbc3c7f9
  5 a5294806-f7cd-7cdd-ad56-9c7eb39898a6
  6 378cede1-df25-4ad3-8035-5c480e7f20a7
  7 efaed2e3-cf07-43dd-9daf-9c829aa8c575
  8 2174bc22-13e2-8a4b-a2bd-dd80e3c5a1ef
  9 ecfab278-961f-5e36-a03d-9670244aaf0e
 10 932f2a7d-5c7a-6af9-a081-d64e817c23db
 11 21c6e0a2-f060-59a9-87dd-bc668bd4bf44
 12 7715c144-e99e-84b6-8c6c-9bd2b22d5478
 13 2610a382-26db-5498-b0af-5a06932707cf
 14 94a39173-bbf5-0c2f-b339-9ff9deedf6b6
 15 d922a23d-69b2-415f-95e4-c9d5abc37dc8
 16 bf390c58-5e1b-5993-906f-2a4ecaf175b7
 17 55920e7c-bcbb-87c3-b540-d917250fcaea
 18 d65e5375-3790-852b-ab02-0d125b33aec2
 19 7535a7bc-978d-7ac0-96a8-323db4b938e7
 20 67f37689-d0d6-63e9-9056-c7143332ae62
 21 8ff4ab64-9362-7ded-aeaa-2b2335f08b6f
 22 e275d4a8-2b1b-7194-8caa-64c3fafe0ed8
 23 e6d1ea18-4ba5-49fe-9f4a-57865442f68b
 24 24616542-c475-8165-a02d-bb92379cbca7
 25 64d03886-bd0f-055e-81e6-e74686eaacf0
 26 e5b4d724-078c-19d0-bf3c-d97c593971c8
 27 124e78b4-86cb-4837-9c87-e3c5ac153729
 28 6613670e-c3b2-3936-a1f2-4d5230928010
 29 7a0332e3-1702-83b2-82f8-ff9f9de12d0b
 30 15545551-760c-2c91-b0eb-1a8571d32deb
 31 04474e06-6b79-73b3-80a2-c593d43ab5f4
 32 3cd9f17e-60f7-131e-bf29-bb877ce2f381
 33 6a97862b-7d1d-535b-b3de-04e5913c88f0
 34 25459e65-1ced-8bce-94f5-236e654d14b9
 35 4b320939-be61-371b-a9e2-1a551ad59247
 36 d53beddd-8580-4674-b0af-324bab804329

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 535574485658504588767748014382715834. Exactly this sequence comes out of new Random(595).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 16 of Run 11 (seed 37,057,156): new Random(37057156), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 09:16–10:46).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs