A858DE45F56D9BC9 archive

201207071956 w76zc

explained decrypted filler

seed 345

Metadata

Post ID
w76zc
Title
201207071956 → 2012-07-07 19:56 on A858's clock
Posted (UTC)
2012-07-07 23:54:45
Timezone
UTC−4 · title 19:56 against posted 23:54 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
38
Filler GUID seed
new Random(345).Next(9) ✓ verified
Run
Run 14 (seed 205,976,312) (seed)
Draw
1 · predicted N = 38 ✓
Machine boot
2012-07-05 08:28–12:28 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

A9E6C40C94922D78 974EC0ED4A137480 56259CEF219AA17E 9AE872DF01467BBC 27F759610CE82B7F 81A20A8555553563 60D0CB6CA884DE96 8389A75EA047EB30 254EC2454D80A9C3 8C84D56700245C57 E57A6BE7626150C5 6F3EEE02764F454A 739B230060BFD6BC 6EE4F1871823EA3D 7ED18BFA5FC6BDE8 BFAF4D9A1F943306 EB784477627E4CC0 D6A32ADBBB0BE313 5A158CF68AC38915 B97B61B95D7039D4 4F95ADEC16A7C2FA 96DACC13C2683977 837F849925D674E4 5440FEB9993D1E88 6759C9DDB68103C2 9311B581778EE74B 717D810A0D605D15 8B6073C6DC248590 87068060B79079E1 5A51C4FAF9C77B8E 61BC0D4CCA158EF7 F8A64C71C4774A38 BE576F37091B9CF6 FCB25C527A9C7A10 BE2F4E8AC4EEBBF6 CDBD5A63C0214660 E4712AA32FCE2CC5 EBAC2135A927AAE6 F6436ADAB0CDA3A4 305EB6D3DF0CBE60 BACEF6F4C752B253 9CD2248A1A2482BB C83AF0BD3A5A6F6E 490574CF1D780790 B46A633787764A4B 937A9D29B463A591 48CBF48668651EE0 6A29C86C01270897 528D26A881182DD5 2DF89A65C827A629 CDEFDC4CE6101B18 ACDB0608E71AC57B FFF97500DAF22B4E 7B867B0DDFEF9C53 DBD1FEA17C8EA4EE 347F39DF8A62EF1F 73CB5BB9B9410E0D F145EB47232AF8D9 3002A3F532A0E1F2 C272CAC0DB6A430C 5909CCF87B6C41F4 AA754B3749F199F1 870754B0A46EDE64 BC0BCEA1F54B98CB 775E053AB764DEAC 1C4F85F47A36394F 37EF44540F30B9E1 E17CF1276A8CA2EA 74CA7F8ED83A3AA1 42DDF130F2BDAFFF DCFE789EB41A9BF9 3BDF2708D689DB1A DC791F0FEDF58170 F6D781B3F8820CB6 34C8FEB971066784 915F8D4009E03635 96175515B5CD8A95 6FF0307B725A3606 B71CB2BAA57308F3 663A81EA779723F6 7B1476F1B5B1A0C9 706F928B0B651880 87EADBBB10582AD2 79115605C5656607 023CD0B31C8193CD 20161F4AEBC3C2CC 6DF8691990F6B197 283FEB9EA4EB3C57 03BF84B2830C3764 EC5359F94EF50722 FD48241EB99428C2 7D65E680B72D9137 8E7E7A45CE04CEE2 CFA4154640101CC1 614453825CE9F104 D4A4471F5604C9A2 58E77131CA81DD9E FA7DD6AA852D8B74 A8531EF472B2BA99 722794D04871E77F 4531EF8151C325FE CDAE80B19D417CDC AB10FE0E3C696AB3 3CCF0C9C3CB45725 5A58E93D6F3BF3B8 E5CF3FBB543FAE15 7805A313AF6355C7 5207F84D52ACCCEF 08E7D8D3FCD52C87 3C4E0E214B920C68 F4D87F09A9891B56 F7CED7812001FFE2 A5CD8C123BF8C302 4DCD1A9DE37BD11A 22DA94C2B0D97FB3 68EFF7A5C40C5F5C 9F21677206F31B51 727F3EB083E39325 A2469DF0A4DF2B96 F3BBF889C5A8D3B7 5078FD42FC1F03D2 53C92DA2DC6C885A 58DF1E455444094E B85DEB74B3F4A7E5 7AF91BEA259E5DA5 CCEB349BBA49A19D A5A258A8F8631503 245337A113A506AB 8E0AD70851619EB8 876CAA770BB84202 C0431F55D9C20C18 C7CD2EC8B60E9F60 46FBA53157AD865C 70CA80D4B6D9205F 21CBCCA16E44029B DF14407E578CE3D4 2BDFFBFA8B4F7C63 605CD2894DE9E451 5F5701A481F46472 7AFB844E42AB0B4B 3B05542C520039FD D73F0F03B99EB6B3 1A715A1B4474555B 48F7F2B59AA4DCC2 8C403456D1A6B88B 5A1AC885FD2D02C6 E738AEDF4FFDDC3D 3B0DA245E50FBC94 B7EE0AD3B2BFEDA2 81932CC898BC4DA9 1600FC165C0012EA C5A71B9279AA33BF 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 342f6d2c-e261-8fbc-81c4-e32b607b7153
  2 ea30d1d9-6611-0576-b5ce-a7486cb1c696
  3 36adee9d-c7bd-899c-9700-a9d07b5557b2
  4 e058d28c-5ae2-1e26-8582-6456259090b2
  5 68a4ff6b-feb8-86ed-a56b-3ea915cae863
  6 4f131f15-a1a2-0293-99ef-b5ab9d0473ca
  7 8d1b44e6-41de-4542-bf5f-c0ecb221d282
  8 f8efe089-df7b-41c0-b422-c44315f3f9c7
  9 9096a668-80f5-56b9-9b02-160efdcf2c78
 10 950f7e9c-c9b5-449a-96d9-4e5608d75f4a
 11 3e289b8d-1ad0-4da5-83be-be42d54ff639
 12 b1e7c1e8-550a-72df-b056-f5dc17367d85
 13 531d3568-9cbc-746f-b8ba-afd12fbd9357
 14 37da8896-0824-881e-b98a-38caf4a02e15
 15 245c5a4e-9152-4371-a1aa-8cb02adcdc0a
 16 acccbbad-2462-4acd-8bb5-5d1f0e45cb8f
 17 9d220c1b-44ef-74d1-8443-13e4e43ff8ff
 18 5fb9f0de-a940-859a-8fbd-4f931a4a8856
 19 60dc3d86-c8f6-046e-87bf-a3fd1bda6c2a
 20 2c5c0cac-2808-8e6f-988c-59d455b2ba5b
 21 9cf9fc3a-6e8b-5d9f-80b2-386d602220c8
 22 2c5a8f48-16ca-4af2-98ab-2b1d82b96a82
 23 8ab66860-ebeb-269d-9d4e-ae315ce1e14f
 24 c2698e61-28d8-5aca-8800-6bfbe7fe56fe
 25 7b27508d-d945-43b2-8df9-47dd944d8fd8
 26 cf98847a-d641-33ba-94bf-ada731f2defe
 27 e22bb612-6813-4927-b263-d7a9854ac9c6
 28 8558d58b-875a-4a01-8afa-ceb6f381026c
 29 2bd23be9-8e2f-7520-9b28-1c85ec038aaa
 30 e0f606a8-b270-8616-9c77-9f14d067d544
 31 d2f2c42c-80f5-4474-863a-3327a6779b12
 32 8eb09574-14f1-2da9-afbf-becc611979bf
 33 1e5a9d6a-df67-0f5f-9153-4b640a1f44f3
 34 6ff64cf4-c358-5ca0-8da1-666cdc417d45
 35 7422ea98-16f7-009f-9947-2d9f2527da3c
 36 66769b10-46c5-6005-b045-ea504beb24de
 37 1c6cc636-348c-7fab-92be-28ebde25658e
 38 4bfe1b04-7852-4306-85f8-1d25e91cf9fe

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 80818044544778447808542543447842050674. Exactly this sequence comes out of new Random(345).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 14 (seed 205,976,312): new Random(205976312), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 08:28–12:28).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs