A858DE45F56D9BC9 archive

201207082217 w7xo7

explained decrypted filler

seed 522

Metadata

Post ID
w7xo7
Title
201207082217 → 2012-07-08 22:17 on A858's clock
Posted (UTC)
2012-07-08 13:15:10
Timezone
UTC+9 · title 22:17 against posted 13:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
25
Filler GUID seed
new Random(522).Next(9) ✓ verified
Run
Run 15 (seed 117,733,640) (seed)
Draw
7 · predicted N = 25 ✓
Machine boot
2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

709F769AB3D24AEF A6E8D4AD3AA57788 DA546923904D3B0D 7D8AEB3C43E19F40 C7A5F4590D53BD44 98952B5400A48E32 C988E9DD364B20D4 5D42E1600A258ACF 0F22746959A34EDA 2A4E80AEDD264147 87D9B5BD17FB24C5 77368028C70DE8D9 8386AEE1E1055505 6B00BD6C0A0DEDF7 9128D98856AF6777 D5E61C4EFE5A6041 D35245899BC23B6F D797EADB93474E3E ED078D1F48B0913E 56A47FA4DD6C93B5 4FD81BC144ACAB9A 099A4CBBAAF8AF5E EEE29080BA605456 FE9A8E6468F9A73F 5E83D47C01FF995D 28DB96EC4A2660C2 210480836798BAC2 61F48DB60DB7AD76 B3A69DE70ABB3F66 90FC6642322CF4E3 8256D796965DB084 E41C4DAD50928BB8 6ECD3C9BEBD0E552 FAA7FC80FEC8F018 29A541B1C873DA86 7EDFDF1DF875132C F809361958E6E274 B00D4441E442802D EE7674F6845158F2 BB5261D0E93419A4 3D50B6732E90323A D1BCB2C1ED3FF71E C23C966836CEDA06 4FAA1B46B0374918 9631A62F05737176 8B13758DBC9869D7 D58EE566E1774D17 A6CDB64C6E1B514A D2ADB4CEE940EECA 25B5944F61265992 8DBAB2A347B4E5DF 167850D0E2D93069 A8A906A65884F0B7 FE355B170BFFAE37 BF0B79F32F5BE081 D21BD5C96F7DBB3B 92672E5532942C41 0B499147B2F4C5E6 F62C1496C9B651C6 BD9224D62F5CD589 55F895BF3BAD93AF 3F168F798A585024 8BBC0C083013845B 6DEBDA4371D8BE2D 1E278C81E423E654 8E9D4C72360093AD 9F0C7FF088F86EB8 1B4B7D737322ED45 597AC5ADF2E83FED 3085730AF62FF89A A756E5757B08BD98 C83045DF17313E4B 4F6AB8FFC110EB81 800568DFB7903882 EEC2EB0185A8AFC0 7A3E2769753E5E06 091315766C82C9EC 989A8CBD243AFEA7 6FCD1D67C09D0D64 1D73216B704C3C53 3C434DF3C9BB8804 0633E191AC570B39 B1E8EAD5D3457348 8441F94AB99BFCEC 78F1E8A848C0C5F5 0508E8F4394F47A0 727B1DB401204299 BC843B9F1D63387C F52CDD643B38452E 9E555965638A4E32 E7212915FD82CC71 45A349396F343E9A D613ADF1F3FFEB70 A06F651CFA71DFBC 206786220215DDDF 146EE6A6ACAF5414 B8C942A66D6BC79D 119CEFFAF83459DE FA281C2D870F813B 877036717D373E5D 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 98b0edaf-3430-3f9f-aa03-15019624096c
  2 98e84c40-ceef-8308-ba5c-2a62fe4acf3d
  3 40251795-dcf4-5cbd-911b-51585bd16a4b
  4 0416105f-b9b2-83ec-ab10-820bf4d2a860
  5 dcc1d896-b0b3-7f34-93bc-e43cac12f6df
  6 5ef57767-8fa2-6e29-a453-9b02460a735a
  7 8d1e2a2d-e98f-7f63-97e1-e5d5496b1da6
  8 0378af5d-cda7-2db9-b296-6c0f3815efe5
  9 b7c4728c-4016-549a-a703-2a08ca115ae6
 10 f4be833b-57a4-6f1f-a044-4c2e60b0bea6
 11 bb67c083-aca4-7bc0-be09-abbc3a3dcf26
 12 f54630f1-74dc-0324-92b0-e7cbefabb676
 13 e54028c0-950a-40b2-980a-977d6abac53c
 14 0b987e07-694e-099a-b0e1-9a4c61620b3d
 15 640f9f5f-8338-368a-9841-5234d751a93b
 16 39d2eb50-b74b-030f-b61e-483b9ecdecc6
 17 9be2ecd6-5127-294c-861f-f367fedf1d78
 18 f6759f89-0cac-5e3a-a515-e21caadb7fad
 19 73932a36-6f2c-7cee-ae88-eb48087305be
 20 dabc0fbf-274e-359d-9071-6365ff8a0059
 21 60631536-49bd-1d3a-8dcc-6650e5f5a154
 22 92ecb4ff-e0cd-875c-b681-9207a0c5e80d
 23 99618882-2a28-1e5c-8253-283d416f5f80
 24 1b5e453a-e065-3d66-976b-75df23b10fb0
 25 4ddfd3af-52c8-7785-82ef-c422ef2b0789

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3858767256704030257318137. Exactly this sequence comes out of new Random(522).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 7 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs