A858DE45F56D9BC9 archive

201207080916 w7xo1

explained decrypted filler

seed 17

Metadata

Post ID
w7xo1
Title
201207080916 → 2012-07-08 09:16 on A858's clock
Posted (UTC)
2012-07-08 13:14:57
Timezone
UTC−4 · title 09:16 against posted 13:14 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
37
Filler GUID seed
new Random(17).Next(9) ✓ verified
Run
Run 14 (seed 205,976,312) (seed)
Draw
7 · predicted N = 37 ✓
Machine boot
2012-07-05 08:28–12:28 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

499D4C2C0A9B3D9D 532DCCA6D6A8710B 6F9C08286CD7A154 706C05D4E72F229D 83C333FAA472CEF4 03D1628B046B6D7B C6629B135951F6DF C98A8D8811F40D64 FD668017B08B1D22 C2749190832DF16E D13FC10EE2A5857E 15A98ADC8BC45CD2 6738119DD65F76D1 15907698E0AEB649 179044529615F8B4 84D555690667F8A4 7BB8D1CF3CAE3575 EF60B8CCDBC802CD 31515B3888648C2B 483A87D8FBDBE435 14765915160FB6A6 F689AE421E656000 DD78EBB02A9929E9 F545797FF1B3B654 8754102FB0B42FAE C0A270FE66A0DA43 35354D2FFCB20DBE 39BFC194508B2C65 2510192CC1829810 7A381D981F21C008 E1274C4956F1416C 39B4D4BD51B18FDD 8F7F20F5DE568F94 762ABB6124A21FC5 FB7F9CB482B76CC9 AB2D656FA240B591 BB85B33583256995 67776799602BFC41 0F2AE73BB768F4A3 D169E7C5FB38CDA9 3A4FF97605E81AE0 B594834381B2A1B2 A4C72815F5496222 3FA2BB88AF946939 245B01F04642BAD4 34E810B83E4E1519 A82879EC2F48BA65 6EFAAE8C32ECC9DF 5BA3709662EFF1BA 2F6F0C4389E8BBBD 732E805FF5206006 18FF1F941A9B1CEF 23705CAF0ABEF49C 7EF304CE2EDDC233 A6D0B361B19E9B40 855998EA4FDE63CE 49A9638B3B2B2211 8485B40B1D5BEDC2 91B53032F57F0C60 21FB35B7DED29761 0BCF9EFCF19974EF 5A7E73AFD7E3046F 46D26D1B6C061737 DE1C87C3DA1657C7 1D326A7EDEBB45B7 B282076B0130BF83 6E269DB50C6241F9 89C0FC4043AA8ED1 FED62781F94635E5 B05B617DCB7CCFFD EAB1C0AA3E7697E3 4660666BEF9312FE 73D9EEC88A622B28 C64D8BEC378B34E0 B9E209284A72C1B7 D9FBA901D8897178 A9861AC39761540B F7145B2ADA2561BD 17FBB8EE83E03A33 4CE014D534A2C249 C0337A0118E8A715 812B057A08309791 C61801C1F9BC638E 385BA29D87E42BBC 3314D191F480A953 8B23D2232F0EC7C8 5EA6D25D77255BFD 0D0CA83F0094F41D 22FE421EF0D5C98B 39E0C222C4BAF20F FA5469F40EB0EBD2 737FB3AB4EDBCC4D 52A30F15CB676925 7C34CFC9EBE3935B 4A9662B75893B6C6 850E74F01E797DF2 EC6A4421292C28EA 23E15365C33E3593 43E6E5004391F40A 2798D01B18CD962F 4194BF61F27FAB29 601EF92CAE50CC64 F01FB080AFA86C02 A4F5F5B58A8C2118 F1B772A0EA81B60F 89C01832755713D4 307DC14A63D480E6 FE67ADE24709EB47 305281B542CDB6CE DDB69014DAB249B2 FFF1501F583515D6 8274753BF7F2B2AB 3C195ACD80CAB108 23827B0B80908B7D 17C915B4A0326762 1EC78B1FB0C0C35D 9F78FC0256E938AE 8FD8A6EF33DC0941 43748EE128021A01 3285EF3833B91A09 76CB490542816790 EAD3DC457F638D56 64B9F9C0F9D7D73F 6760F9852B3DBD4D CB225CCB9759AC63 32B0FB78807F9124 DA39A955E4F2B641 93F9880A33B2CFBF 658784BD476CECBA 91144FA37EBFD74A 5DF18C2DA39D1005 709A5384E9E046E9 CFF76C80E409C4B5 3C4402729A8B6A23 46703D6E5F9A44A3 4C864099035E6E75 18AC9D65A0D0E239 185487E3BC243254 9B5CA6070A3ACBA5 CC3CC8150211C8A3 CD447731982A11FC D175E51739781AEA 147F537194280AAE E0653F0AFA621325 CBDCFF5351124ED7 0F7AC6B57049987C 173B5955F9F86FF7 5CAAF094797B4A02 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e5cd8cdc-4fc6-5751-b875-c435eb9cbcf7
  2 dd073437-7a18-7624-b1a3-f56d00c1f4e1
  3 abbdb3ac-3a83-566c-9dc0-05626e55a3fb
  4 2fc9cd9b-78c2-142c-ae58-a19527cbddde
  5 7d1f2ad6-8f1d-7080-8540-b2e679ae4898
  6 b85f98b2-77e1-3ba9-bd05-704c3221a1ea
  7 f96cbdfc-a2ab-401e-a5f7-a1c6707fd47f
  8 d6483472-2e0c-86ad-a310-4da722ca69d4
  9 514d8421-8754-093f-bc34-8b9b6c8e88a7
 10 c97446fe-30c2-471c-8a72-4f71fe83fd45
 11 7eab8b21-3188-77a0-982b-2f46f6e61a50
 12 191f08fe-3cdf-6474-b4f6-a7c310da87a3
 13 ecd0836f-8eb7-24de-bd6e-087b1fbb93f1
 14 f74e2ad4-a5af-285e-8b2b-003e833cd568
 15 93d50e97-dbd9-73eb-9ff2-d26207871898
 16 c1925f7b-43b5-5b87-913e-bfa7f3ee3300
 17 7076db01-fbba-0579-bc3b-90f8a510bd54
 18 cee0cad0-4811-443e-8508-b3f04e1f7748
 19 32fe3288-2bf7-1262-8c8e-01d3d5a4db20
 20 d6531230-3fc3-8f1d-94a8-f3c2821d3833
 21 6c58fc1b-24ab-04c7-a4ef-52ca37c72b42
 22 d5089631-e32f-01d1-bb17-ee2eb1c59f93
 23 0a5ac1bb-1b39-7e99-8375-64050c136f1a
 24 e44ae5a7-5f2e-876e-a7b1-5d9060a68888
 25 0a6282bf-2461-3e06-a2b8-d2dd2d8b5a0c
 26 659bfdad-0c78-40df-87a2-6ba5b2f8dbb8
 27 25368e79-f59c-4eaa-ad9f-120d6ab21a62
 28 1276e0a2-63fc-16c3-9587-9623130791df
 29 99f9173d-6d21-2f3d-b45e-592e84249737
 30 b4250ac7-a4d4-6c84-8bbe-d3919c01a198
 31 c9dcd5d6-b9a2-4a72-8bd7-6ea7467fdad8
 32 758f62b3-0cf4-88c9-9f7a-a0bf2e10dce2
 33 3fe5a992-aec5-1cf1-bcb9-eea561a7392d
 34 4ac9b84d-3f24-3133-b4fa-d2d24ff54e0b
 35 3dd290ed-b5f7-51e9-b8c9-de9a1d412e2a
 36 2be18610-8496-4570-96b1-a3ba1254a003
 37 64866092-d2f9-1712-9e53-35f9c63c2cce

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5751734804762275041800783441264813541. Exactly this sequence comes out of new Random(17).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 7 of Run 14 (seed 205,976,312): new Random(205976312), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 08:28–12:28).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs