A858DE45F56D9BC9 archive

201207060206 w48wt

explained decrypted filler

seed 800

Metadata

Post ID
w48wt
Title
201207060206 → 2012-07-06 02:06 on A858's clock
Posted (UTC)
2012-07-06 06:04:48
Timezone
UTC−4 · title 02:06 against posted 06:04 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,808 hex characters · 904 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
28
Filler GUID seed
new Random(800).Next(9) ✓ verified
Run
Run 12 (seed 36,542,234) (seed)
Draw
16 · predicted N = 28 ✓
Machine boot
2012-07-05 10:25–10:55 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

0DCD1A6CE07F592A 7E14C1C8E04F2F56 D29FE5D31ACD297C 6AF02A9EB1719E9B F5FDC4B4FEF44ED2 3712D4A994F3D746 AEA28BBA0EF097A4 ECEFFC055AA2B696 DFB863CEBE51E864 EBC3F5BF9DFD2EFD 161319F28A5F11F5 D93916A114AAB7D8 8A96A0A38CC84D03 216246F0B98717C4 D32623C0C2CFD376 653FC6BC127CA878 1316DFCE4A8FDAA1 19706D8EA30FF28B B0B68CE35BBBA8A6 EA2C6BB34DEC4658 7204D20104A98670 EDB5AFA25D6BFF20 3B501D36352153BB F8889809132797F1 77DF8B5B5B0367BC 2FA32BCCBEB7AB93 7646AAFF9B57F332 7164E4D9D3E24A54 F96D96EAE3989DA1 8E72F4874792E512 920E331D5D76ACDA 3688C723B9BB7654 8C4B7537744DBBC5 522F61EDE0EB1934 9DF4BF62EEDEFEF5 BBF1C92E3D8A6B8E B726EBF71EF0BC33 EF1503DE4A665051 C4E824C1D9DE65BF C9AE7D13E8105F47 82D4DBAF06194783 DE97C4FDB398FE57 BBD80F0C2CA9D1CE 94416D944A9FF22F B2E7633AFE39EB38 451CCC58D886F36D F87C999BBC14709F 8097E126E5462478 4FE0266E007C988C 1D4F44DF5A17B886 88D7D2B335FD1BBE 8BE1CA6D82DD1CAA 8F73F94B327D7FB0 61A3A4B5D0404671 7707AC290C93AD60 F343798D71D1A2E6 436BB9321CEEA914 28BC35D33602E938 7A87261656B460F6 9BDB2EF3675AC694 012CE1F62A612706 F6167C4C4927E47E 4F7D70C178A46F04 6FA073DE2D0251D3 12029E95C7756171 3E94A0930638E9E0 11669E563C56C356 FBDDBE0C7A6117E6 92BE5E30101A4476 4F0E0864021C0EC7 75B8F55DECA22AB6 C8F1A9DA4032F5DD 6751A76AB3EA52C9 18047EA484F00C05 4C3DC69F4B8C98E9 2CF22B58175A81E3 3D7AD37E0C35F864 A3D90194F406597E 3252B4AB24B5D755 3732F1C06FBC184D 0B72875A4320FCDC DBF1EA80F7994F56 786CE6BBFDF77CEC 94F219993A1B2A31 1F7F54928BF3EA07 ED1B9CF40BB9C9B2 7B04ABE31A8E8C38 7B46E11ADFCBB403 95C9EE801137DB0F 4FC2C2A5B0ECC47B 78AFA7732FD4444B 8D7032FD20515645 B38666BD8BC50BE0 CD2FC53C94674D10 FAD7276DAB86498E 53251D8EFDAF914B D1EDADEED4678CF5 7212A331E1FD7E50 3CEB01AA405DFEC6 23425A212AA7E26A 914E2033CD219629 96DD3AA714B405D3 4EEFFD18D3B8897E 5D5FBC3463AAABE4 A262D20BC54C88D7 A19AC29296DBC6F3 48A1DA75C2F81418 A545AC653DAF774B 3DD4A4E641B6E6CF 1DB56BCF907DFBC2 71E93DAFB547A047 4A55412EE04E3A9F 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,808 hex characters = 904 bytes = 113 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 28 GUIDs as hex (shown below).

Decrypted: GUID list

  1 86dba40a-23b4-563b-96e6-9874e415e920
  2 d9272e46-736d-411b-acac-39e7357745cd
  3 d034f726-131a-8e92-96a7-87e2a25e6e0e
  4 814f5da4-e4d5-2e87-9012-a1e446e2b2ee
  5 d8b3e823-b1b4-3c10-acef-2e1b73f8706b
  6 5facf09f-7db4-6bb8-b4cd-9686a0bf5d2b
  7 d85ed6e3-28cf-3e9b-86d5-62c781498420
  8 6e01a262-33fb-7b49-b8e1-0faa681028e6
  9 b931bcf2-02e7-8636-9265-526f39d9e4a0
 10 7610226a-f981-2708-b684-ceebade671bd
 11 aaf03a03-4d3e-6950-8274-227ed1fbaed0
 12 6f6aad27-4418-08e1-b87c-8a9a3ed2fa9f
 13 355a1ca3-65f3-542f-b6de-81115cf7b87a
 14 e80d4f56-4da9-67e8-8fc7-ada239db902d
 15 40b7a879-ba2d-80e2-9f44-78aa6347466c
 16 cba7b127-4480-50e0-90e4-ea7114a5a8be
 17 a8ed3d2e-437c-13ac-a04a-226f182b588e
 18 fc8d9231-79dc-8437-9973-f48cf89ddbb9
 19 b0631c8b-d7a5-3e74-8746-2611f3f67a7e
 20 f5ad81df-d63f-0a8b-88cd-7e60594c8e33
 21 6c492bd5-74d5-1221-935a-041c81b20c46
 22 57a6e2e7-2aad-1a5b-a3cc-e073b167ef71
 23 305f7564-b026-1da6-b723-657299045cc4
 24 fab985cf-067f-46d7-9808-ad3e9903dfb2
 25 1769a5e3-3438-06fd-a88a-4dbdd7d04545
 26 56c4643e-a9f4-012b-9692-0f0c8b7e2fc5
 27 cca3417d-0bdb-61b4-a806-fbebea9c397f
 28 03d97c16-e81d-38c1-8cea-f0f05284f76c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5482363782605685183011140063. Exactly this sequence comes out of new Random(800).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 16 of Run 12 (seed 36,542,234): new Random(36542234), Next(8,64) per post. The RNG predicts N = 28; the post has N = 28 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 10:25–10:55).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs