A858DE45F56D9BC9 archive

201207081750 w7sd8

explained decrypted filler

seed 523

Metadata

Post ID
w7sd8
Title
201207081750 → 2012-07-08 17:50 on A858's clock
Posted (UTC)
2012-07-08 08:48:24
Timezone
UTC+9 · title 17:50 against posted 08:48 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,680 hex characters · 840 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
26
Filler GUID seed
new Random(523).Next(9) ✓ verified
Run
Run 15 (seed 117,733,640) (seed)
Draw
5 · predicted N = 26 ✓
Machine boot
2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

043B513D44B88DC9 A5A4E54EDA1C0BB8 5240FF8A32209B47 3FDEAB50B32FB2DD CC01AE7CF6F8AF76 250BA3673D3003E0 37A304ADCA6F1424 2DA4A53A9C7C7362 448C40FC1C6412C9 8E8AA1C7C9B70E60 12388CD7F917B6AD CD6E448A4C782176 D8F8C7D91E69E940 592FCDFBEC8C5783 0B8D2C34F6126A07 91A522A13F5466A5 8A9D5340CD52BEE1 15F0067A2AECC6B4 CD6C4156475F4485 11B7DC35ED441F28 19A0300994921E24 EC0124D528DDC53F 3E1170F090EE634D 23AD9730B968792A 33CDA5CD1555643C 675371AB52D6F658 9F9B08A85087A1CE 2B63EBDD5F8FF0DB D6F9236A47AD724A 1E4263943C0CA8EC F466E14BB1DD30EC EE00424E890B5E3D CCE58ACA60B7F275 B6F79D459359FFA9 5C64BC1165C9BF55 A9DE5D0608D123B6 B0DB43CBD21C93FA 9A78E93C5D7D3330 6FDA8806E5E3217F B890CDEDAC608852 E7347C81C29578CE 5A7FE24B7D460F3F 3AC13983A616E37A 53FBD8F404280749 1F4E086B9F196121 E3E89A9C21715CFA FF790E88D8DD0329 879DE508F6C39C5A 121AD141A42BB57E 6942157A1B996F57 64482A8159ACBD91 7C65756062AB5E7A 55CB8314B885B789 809E021098B113BB 57F5EA9AEBB2650F EE1E93B5323CFC78 FCE3187C5AF11CA8 5A17B43FE5909128 D68C357CBFAD227D 556223408F09ED48 CC9C107E228B841B 6D4C5C32AC60BACC 4BC2F766D25BECE4 790A24C6A3E5AF88 B73DBB3108E90437 0DDCEFE6CC7E6893 B10134E164BE23E2 6D3A1E772D0D69FF 2580C8C3CC912709 BFA2B527D747293C 776E5A760161DE47 CA6BF53FBE4D7FB9 625A9173DB4FF126 CAFEC68E51EADE95 EFD91A496404C110 A449062C447C1D50 546CF7292ADFA3FE 6ABE8CF9E80535FC 8586DD1333E92E9E 4F8B2BF88EB0E56A 93A53BA09324C6B8 3592BCEB47119A39 E2C2DCD2FD257B99 1E9A0E78FF618E7E 820B83553D8D864F E8D0ADFAD8513EAC 689F0D67A5184458 D07512A860C086A0 5575430F6044B0FA 5A7E47A56732E97A A5A4DA86C5EB25D6 589C5A76485E069F ED56CC61A6C53FFD 3FCD788BC1731075 6142BE364168E832 322484740FE8BC1C B2BCC35E0272CAFD E4900BCC03AED64F 37B139261DC675D9 966CB63091EC5192 54D039D6D78A0014 DAE9D445B3B75D5C 61C306955A25354B D372373DB08C0DD6 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,680 hex characters = 840 bytes = 105 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 26 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0e21c475-2329-824e-9a99-b4cc4d527302
  2 133657d0-7f3a-2520-9277-792c91e90d60
  3 30c84a05-a864-3d9c-838e-6e127407e364
  4 66dd09ab-2b22-1b7f-953c-411a194af739
  5 a921a622-6f9a-2fe0-a377-1b4ea982381b
  6 e82dc5a0-509e-5b6f-a2c4-2631f882dfe1
  7 6a22ec7e-785e-28e3-a42c-2b28b2ba8d0d
  8 4475d28f-843f-717e-ad1e-fbb882fed67d
  9 6bb4fd6e-35e8-66b6-ae72-8a499b550243
 10 b9372d23-4e02-1c0d-a075-51f8eddbc8a9
 11 5aa0f4c8-6374-5070-92cd-8d97ce7ca32f
 12 d7ab6b8a-8058-7833-8130-18b40bb367aa
 13 565cf738-3766-1629-a24f-d3f2f123396a
 14 2f7e7659-d072-5fa9-bf20-a470e2ef9147
 15 1d52056d-407b-038e-a23d-1895694af2e5
 16 a4bc9280-a611-577c-be5d-e716ca8ebac7
 17 23a4373d-a5fc-6067-b5c7-b7997ad83898
 18 bc14f266-1099-2ed8-b91a-a70b5d10b351
 19 eee329dc-3d3d-7dc3-a6c4-fe0dc6c20db9
 20 89c463b5-4f9f-71bd-b5e4-a985605eed4c
 21 cfeaf608-09c3-2053-96f8-30e4e82d4d13
 22 043d706e-417a-17c7-9a79-ed6004ce3651
 23 e0f9efa4-c6a6-37d7-9767-9d808a353f13
 24 5c706a03-cc7a-6edd-9c09-660638635694
 25 dd5a1590-a6b0-837f-b724-0452617e6af7
 26 60e73f7e-a323-89a9-868a-98f92f6abdfb

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 82312527615715056277213688. Exactly this sequence comes out of new Random(523).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 5 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 26; the post has N = 26 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs