A858DE45F56D9BC9 archive

201207061509 w54uu

explained decrypted filler

seed 77

Metadata

Post ID
w54uu
Title
201207061509 → 2012-07-06 15:09 on A858's clock
Posted (UTC)
2012-07-06 19:07:19
Timezone
UTC−4 · title 15:09 against posted 19:07 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
25
Filler GUID seed
new Random(77).Next(9) ✓ verified
Run
Run 13 (seed 19,267,593) (seed)
Draw
1 · predicted N = 25 ✓
Machine boot
2012-07-06 10:46–12:16 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
12 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

7E04D7BD34ABAFA7 1A8CCC09CC532BBA C4FAF647C7D6FAC1 6906918D1AEA33D7 40C55180E067CB6F 5A239944E5236743 D19D16F1101403C7 08E3DE94498CEA51 9BFCD9BBD779EBBB FC99798E2D8109D4 066184E554076E3B CFDD106EEBB833EA E978086E73C99CE0 69631A41FC5BF508 27AB8415DD07BA52 0A77697139414C58 68E6E666384F203F 51874FA551512ED4 8AA288D55F0BC7BD 6D1F41319D378774 B228CC0ED239B6E9 B9BB57DEBC03EF01 174D3951DD4D4551 A9218562DC7BE604 BA10DC00D8F34892 FDDDBE905B4DCDDA DFCC02D250119CED 85E66B885501632C FD1EF51BADCC4782 4EDC52A108504765 A2B8C2C109CD546D 150878CBD956FEE9 2B69C48CCEB5E6ED D0284E069F3EA8B3 10FF9E5E9DE09A9A 002C24C408F521DC 212E8C5DB375D9B8 3840280BF706626E F9330BD17B43B643 4B4AE9B668F66800 3F4F8400D9FFBF49 B205AB137B654C99 E2787B7B1F3C91B4 F1D38805A66FE9F5 9E7CDDB9367F0383 EB5B04C7458706CC 95309E29A7D9C32F 1523A6D459402584 A51073D39430A31E 638D28133EE12B18 40A9A43989B0423A D1B39E30C66FC66F 7305CD480CFA9A29 EA3FFCCBF063D1E7 4EF03D340B7B4C9A 7A649071B1A2CC03 6B7D6E79205FF0BE 9E72D4C75B8D2843 968C45A479462A18 B1F8B6A8AE308D84 FAABFA48E4CED0BB 6C0BDE0750D1A68B 0230EE9A12DE8514 48EB72BE97F9617D F754B2E2AA8C7809 24298C45CB1C18D3 9051DD1A4581D2F8 9161D920F987C04B 770FDBFB905FFEAC 5C5B4D1CDBF6C2D3 A22416E39F93161E 2BA9C9EDC6DFD480 9AAC0D4C6AA94226 95F81F46851D9C1C 515DDBEB6BC50754 BC9492C1C30A35EF C713DC39A61D493E 83402AF2E5B5E635 28A8D8956C11995D 562F8F537BC6B5BC B65228FCB82FCC61 B5FED45868CA90FE C4328ABD919F2969 9B1825D27AAC4C5D 2AB0132371CFAC7A 355291162620D729 985DBA529A9993BF 5125FBA4C43A99AB D741C06228ECD4D2 71FD749980911C3C E5CF78CA4A7B9F5B DB1FA23F58E0DD05 49733B53D17E1C8B E3C04D78E27610FE F3CB77C526DD9C98 2B2735808076BAD6 386FD1CB68B559B3 D01FF30A22A6AF71 F497F424741837A1 8D48ACB5FEF29550 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 01fe700d-ccbc-8860-93f1-56b647507434
  2 3b0e16d1-92b4-32fe-a685-ce9dbf4196e2
  3 99c7c6f7-bd74-5ba7-944b-504ef3c7510f
  4 6b10db4c-c622-88e7-a91e-d13110f8c66b
  5 578269a5-4b4c-8ed0-8292-33f04bf04c6d
  6 d5743244-e845-7d7e-a545-fdfc6ae55a7a
  7 7523d72b-899c-3fc5-859f-c4e47ace9a85
  8 13cd8ca2-8ee5-0f9b-b567-abb162f53353
  9 5b2d06f5-c7c4-4230-9b75-2600f0d6c477
 10 705eaa70-f0bf-6f89-89dc-3c33f1cfd24f
 11 dfce5efc-0694-0888-be00-d4fac175aaeb
 12 f1f9d884-ec72-5d5a-b8fe-de16e1476088
 13 fd6a7c22-81eb-51e8-8e1e-ac1554e3b118
 14 526579a9-8365-4a25-a530-0086ae4bc690
 15 cd3227fe-e46a-7fea-9a45-e294d70bf77d
 16 9754586a-8fda-13d0-b246-3b42a88903fd
 17 7c381107-bffe-2865-b65d-0db551704b8e
 18 f0ba37d5-d020-6893-bf3d-28fd1a6fe558
 19 0669b2b8-93dc-6792-8035-225b00c0af89
 20 bf90885b-2db2-1504-914c-28bcbf15b405
 21 5f6abe06-10d7-00a2-b1c6-2b3b30d75631
 22 476d0651-8eef-6c4a-bd26-c09e4dc5120c
 23 4ec3c583-44a1-09f6-ae2e-4a547541883d
 24 9ef85789-d5a8-8568-a43a-5a94ae164eb6
 25 7a02bb2c-9e88-2e8b-8728-6692e2de27fc

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8358873046055471266106082. Exactly this sequence comes out of new Random(77).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 13 (seed 19,267,593): new Random(19267593), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 10:46–12:16).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs