A858DE45F56D9BC9 archive

201207070909 w6d6e

explained decrypted filler

seed 120

Metadata

Post ID
w6d6e
Title
201207070909 → 2012-07-07 09:09 on A858's clock
Posted (UTC)
2012-07-07 13:07:28
Timezone
UTC−4 · title 09:09 against posted 13:07 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,424 hex characters · 712 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
22
Filler GUID seed
new Random(120).Next(9) ✓ verified
Run
Run 13 (seed 19,267,593) (seed)
Draw
13 · predicted N = 22 ✓
Machine boot
2012-07-06 10:46–12:16 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: namerun: seed

From the post to its content

As posted (encrypted)

CBE1D86B7A6CB4BC F89DDEFEA8773489 6057B96C7645A8CC 07F29F76D7978C58 0119C74E3107BE2B 85364B64CED69922 A565EB6F3903FC5B 0DE917A92364F4F3 006225D2399652FB B4682BD0DC16C4BE 623D63137C146225 9231AE8DEB123D63 B3E048F05D9CF79E 267D49AC966C5C27 1F7E494AF164D450 2E5EAEBC93433C14 3157602FDE73CFEA 9AFB39A9EB976E0D 6856447723B82FD7 4A34EF5EE2AA16AC B630B9D1CFA3A81F 02FE3B0BA3C12422 0082C607B87D33C0 5D8AC17F567DFD7E 525AF3BFBC5F45B0 0CFF52BF574EBAD2 9BCA613BCF304D0E 86AC779C572C5363 273246E3C05EB352 C1CB98452F7FF5C6 C4B9855CCBD51AC6 2F6420551C339DF3 5108AAED3AAA8849 AE1088DF69C18022 0CEE8E70E86208B1 D8A57CF71FE5C3A3 D1C12C57FD27BBF8 FBF5F795B7CDB932 FC107862D53C99B0 59FE14D8A50245D6 E50C1BF9D7ABC7BA 23F897C739B60197 77A1BFAA86C1CAED A402769D7F21AE5B 28063BF0DCEF1AFC 872005EE8D4B3172 522C53CD83198133 1091569A7FA1E8A1 94B420C07D175612 F7770D62C964FE1B 36DABAFD6CC43B71 9A1DD68BAC0A6438 E7D91BA913759DE6 49FE29CF3E8C6461 EF895B891702128D 76B1C47B7F2BE19B E09E110DC573D9E2 563D5B58FCBB3A4D 0385D60495DCC6E7 C2EB9E0BC6F22302 A13D7C089246AD40 F6805FAB38E22545 A0E26DF98736BF38 005688C6C30B70B4 5D9BB579B754B28A EC6AE9E7566789EF 70D8F62CAA228E3A 812CA22316D2679B 02CCF59E87765FAD 98BCE05AEF86E6B3 845ABC1A8F518B60 B1FB5C7ADC8BE6E1 53893456ECF52539 A8F38E49469C65A8 5A40809A1E5B6B1F 5D15B3F304935A44 725819C89D68DED8 F4683409D2D1BA2E 5A6CEBF0D8383F96 25916DFADD0242B7 0125ACD568C7D3D4 0F02E90DA1D9F92A BBE0D4995CDD9EC9 07985CD03513E88C 2E80155718795BD0 EB597F7D8DEBB01D BF79FCB4F61946EC B9ABA3613E873A3B 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 620fad9b-0638-36c1-bb9c-a3fa2d7c1f27
  2 62d676fd-e7b6-062a-ab1e-d5ac3ac6ccf3
  3 9953a96b-2bda-5c6e-a222-6a0d961e4dae
  4 7c8526fa-335d-1b7a-a67f-4f1c9b184a1a
  5 fba60bd0-9b1d-3932-bcc7-5b58882dd7fc
  6 3d34d8c3-e88a-3c52-a845-ca320786d489
  7 8b2f9df8-6d53-6269-abda-e1832b6f9a4d
  8 576ebe96-7939-5af2-9af1-ce0ef26c3a15
  9 5bc13164-306c-7f60-98b6-9e978167994e
 10 fe4adb49-ead6-463a-b74f-b0beb3c1ee60
 11 ebf7fc27-926b-6d59-a7bc-fe1c17ee8890
 12 459a5c85-243a-1711-ae6e-babd7dc83631
 13 1c2e3bcd-db50-1584-a850-a88456e35be8
 14 3c2f3084-862f-825c-a438-132707e0cfd5
 15 e8940198-3e78-859f-9c9c-237e9df826e6
 16 31196ed2-1fec-88a5-8401-f9ed80f93c2c
 17 b70ccab3-e6c0-20c4-9f61-f6458b06ef31
 18 c5626767-2986-3992-938c-517250575beb
 19 e701ff40-5a01-8cbf-ace7-bebec02b7f2b
 20 245bc103-85b0-741f-8e45-2bc7364d9627
 21 65228392-78c9-6f53-aed1-54cf8e54742b
 22 d168d57d-41d8-2591-90d7-2698883c22b1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3051336574611888238762. Exactly this sequence comes out of new Random(120).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 13 of Run 13 (seed 19,267,593): new Random(19267593), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 10:46–12:16).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs