A858DE45F56D9BC9 archive

201207070439 w67kq

explained decrypted filler

seed 417

Metadata

Post ID
w67kq
Title
201207070439 → 2012-07-07 04:39 on A858's clock
Posted (UTC)
2012-07-07 08:37:26
Timezone
UTC−4 · title 04:39 against posted 08:37 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,424 hex characters · 712 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
22
Filler GUID seed
new Random(417).Next(9) ✓ verified
Run
Run 13 (seed 19,267,593) (seed)
Draw
10 · predicted N = 22 ✓
Machine boot
2012-07-06 10:46–12:16 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

9F9C0838BA689E89 7A545D3BA2FAD279 272751FA201F91AB 74651872936B8FE4 DA5584F5D1CAFFA1 31D572E39377D054 BF511C1C112BA5C7 27CF9BFE19A29657 B4FEBBD065EE3D6E 18381A1E47B83204 5CB00D37F7785EBD C827FA477E12E4ED BB77D4ED1DEE0741 B3965DC3B1EFF9A1 590098A612D4D939 AEFB7A6A6B7BDAEB E93C1A3BE83D36BC F21F2421F3E6E4AD 6E3C0EE64C77C014 B8AB784AA4A44866 3A0EE4C91F7F44D2 FD9384AF8101932B BE6BEBED79C2387A 8D607E5E7DD784F3 A324E66E4F1A0140 D2C96894A4332ECD BD0624BDE30E0C9C B575A78C69A5CEC8 21705FB986C5AEB4 CB1E9030839D87C8 359269C89B0E9A70 3C2E2CEDD2BD5346 8DACCECDC3AB24C1 741AE3E67FAFA084 35042D24430B3FCA E4664C139E6AC9FF 61F9233F6414B3EB 9A452B8882A15B71 D9DB834FE87A1375 032067412FD30F4E 0C9C813D4487EFC0 31E1E5EE2C8CC432 0372D394C8FC6C71 CBD145BE6C1E4384 CDF1ADEE1BA01EE8 E827801D8C0E55C6 782F39474590B6BC 4CDC6AC01EE0F686 7A41562983C991FE 6308AC66432E1D0E 0E731B39BDF1A3A0 0FDC8E45189B06E1 ADBF9E523D9D2478 C7528B5B76BD8313 058076CAD2A7724B 10D78E722F2244C9 6015265E34CA8D2B 8837DF243A9F52B8 9A3090A7673EBB0E 3BFBCC71ADC87F14 73D41FCDF17AAD7C 81EC57E7D7E88A57 E39D2FCB046BA8C2 7895C31C238E801F 489A937BE2B13DBC 0F0C558E721E9BCF CC63037F4F318974 CFA1C53177C1FA30 31EDFD06D6AF2856 0325A5548D98E22E 7B439676FD3684A2 E7E84929F175B93A DE8416D7A111A7D4 C874D596FFBA4B6B CB2EBF7D86A18FB6 A0A7109748636EA8 A8EC1BAD9541FF4C 137B805DB17C74EE 1A4F64DFBCE9E85D 76650FD48336B225 20A438EDDBCBD9B1 AB53BC43DCD6F9C5 F3336A5C71EAF4C6 DFE0262C492F28AC C76F3C36B649B424 9B926EBC9A34A5AC 112164E212A5C624 CA22820D803881E9 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0ca48d5a-7282-5a9d-ba2e-c810e1796767
  2 7824e5b9-57d0-14d8-add5-cacd0c52ab7e
  3 3bbb4a15-ed16-2139-9502-46a1c679085a
  4 8a3f8740-f87c-574d-a551-685e71255116
  5 d09be309-0184-4229-873e-49af14f85411
  6 c243182e-38e6-874a-b0d3-017784e174dd
  7 7da940a4-fbb6-6671-9e3f-bd9a0be4ca3d
  8 a51f5945-bcea-55fa-9e9a-5db541f21fa0
  9 4431a964-3002-5253-812b-c8a7478e347e
 10 81473b14-9e54-09f2-9008-a638382ba8fb
 11 181602e7-ee27-4b0e-b4d4-d7030be3bcd6
 12 7a3864c8-11a3-0988-8a36-999b863cc1aa
 13 85102c2c-95e5-2a05-aae8-7799857fcd56
 14 f650b20a-802e-31cf-b797-839963ad59e0
 15 1e1c308a-3747-70b8-86ba-a7f4ebd8f85d
 16 1028159d-cd56-4b91-b645-720cb77486d1
 17 e43e4d14-802f-181e-8b26-4fe8c3e2cd0f
 18 a35f1f03-37f2-481c-bc54-79e5245efd2c
 19 45c7b481-cf93-8a0f-aa13-c1bdc78848da
 20 7b6aefbd-7b73-7957-b3a0-12ccc224e705
 21 84b35125-341e-28e3-8f9f-9b9c21ed20a5
 22 073c6c56-f9c7-18f2-b75c-8c400a97eb92

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5125486550402374148721. Exactly this sequence comes out of new Random(417).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 10 of Run 13 (seed 19,267,593): new Random(19267593), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 10:46–12:16).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs