A858DE45F56D9BC9 archive

201207090030 w81w1

explained decrypted filler

seed 717

Metadata

Post ID
w81w1
Title
201207090030 → 2012-07-09 00:30 on A858's clock
Posted (UTC)
2012-07-08 15:28:32
Timezone
UTC+9 · title 00:30 against posted 15:28 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
32
Filler GUID seed
new Random(717).Next(9) ✓ verified
Run
Run 15 (seed 117,733,640) (seed)
Draw
8 · predicted N = 32 ✓
Machine boot
2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

EA9E2F67DDD5FBFE F49F758305175B38 866F182F4C532556 7D60D16CD1B50410 8B3EE1FDFDBB4920 FCD43BA340FF6034 FA5BAFA601C2E099 15DDE809B69CA01F 7516925120767925 C3438EE80C1F49DD 49EB0940F49FF3E9 2AD17AD29CABF564 76BD06AD8383E654 60BD58ADEE5671E1 13D74236977CC13F CC581216E1669846 ED646A0E75F57956 CAB6BAAE0533EE54 D6B5AF080102663C A693C3730282BF44 CE64F72ABC36B507 9FFE40B908F04D0F 8550169309969010 B6AB9FB114C94A91 9F93068DD4D69EF9 2A21B61ACF311ACE 564715DA2FB853E3 CA7C70F9E21C034C 3C6B28F0C031AB7A 727B504670DE3607 82E6873F82CCC0F5 C77C95675F68D195 5188E40A0DA9A682 B3DE9908709B44B4 F261DA14AE3EEA76 49A2A63842842189 D544C31446219FEF AE7A26A0DCDE41A3 3D00056F3C1EB705 859BD1E9BC212909 D5E7A673FB607A3C A1D224580D39D81E 6C8C94B169637A22 BA54BEAAF62FA87E 74FDD627E3592325 E0325E5C50D3C5D9 AAC3D8E94025990F 4EC4F991B5C42D39 AC45A340A80CB809 46FE409ABC984B88 B6A8887AEE1C6923 0F273C6441A8226C E8F35BB8B558B3BA A52BCB320396FFCA A2ACA31D2273ABFE 859D8D9A6C1146F1 90110D41C461769A F3538873A8414F40 78727691D4DC8F86 6512960E9D27DDDC A087DF61FADB8B3D BD8D709C842E95A8 FB2D7895DC7DB59A 66FA894D0B2117B6 E7BB381522762A5F 792A290C69330CD6 C00DB0FE86AE1259 0CF6626579C908A4 70C632BE81A735C5 ECBA44791583DC85 BE294C5C52506D46 622E2C9EB9A5A23B 1C0FE5D97F616874 F9799E36321748D9 65E4D486D41CB4D8 77D4575A4DD75168 73F3A42A79228D75 887C2FC0C73AC558 96A3663BBD9D7A00 A36A0CB235D020F0 178DD85B1A34A18C A6D1DB20DC8D7480 A196958848AF4B69 4612F2C4EADBF264 6B0CFEC8DDA60FC7 29A417062ADCEC60 4EC7AA6010CAF688 49470AD1A09B019C 4ECBFF260CC8FDD6 B3C3716BA08583E1 7D918D8CD46BDD8C E4DE24E1DD49B9E7 8EA7853E85BBBA87 5888A389E7259FD6 FCCF06C1F4FD3FD3 172BCDFE263FBA12 5731CCCC51FA1DE3 D9BB5F0D849A1301 EC94C9AF3C1A4CB2 A9F77335001D8D00 F8B649D53D7E87C2 8A0DA32EA628551F 043BB7494231B0E1 66B5326D2E770FA2 718820B0D6DA689A 23B8F0DD04421A44 E3C017E5F7E645C1 4A546D6F02521618 38BC660D7B19D247 8677849F1FEF3029 8BD0AF19E82E1DB2 FB0B2164C5EC2B11 35475D0FBC012C47 0D9E52C5B0F7B0C5 AAE2CEF98016F33B 6DA5900489CC9340 478F288F83CE578F B0287469BF6D38C3 347676EF7D6C30EC 9426348C0EC64C87 4BE9F6A04A33C012 9B2A4DC322834708 B39BBCDA53A38658 EBC011730093F3C2 2088BC69307037A9 2823DB905D9E4FA9 AB324C50BA9A9CC6 7142C328A6D36780 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 17a26d6f-ce97-283d-b053-2c752eddee55
  2 3cef0ee5-4bcf-1b44-a3ca-9243359ac732
  3 bd39674e-7e3f-896f-893e-34be22025212
  4 68608283-7eec-5362-8ced-27f806092f89
  5 92c94597-224b-8c0f-ac94-c41ee662c90d
  6 27c43a7d-ff97-17a7-8889-7316258cb32d
  7 54e265e3-dba1-17fd-b5b4-55a6d8db6c06
  8 1f6e40eb-39b1-175f-82d4-f1e513a44888
  9 d45f3c72-da31-6d48-9cda-729c6be4a663
 10 e2080058-cb44-6bc4-b477-f9ddb43f34ae
 11 d3675995-0053-4ad2-8c6d-c198f55ddf8b
 12 2067c360-4447-25c4-bd94-e2195b98e954
 13 f1dcc0ea-4103-40a3-9715-2e92f2ecf33c
 14 3b9306a9-2312-40c8-a4cf-8f8864f981eb
 15 35951d05-ebab-7507-b9b1-e11a654a76c7
 16 95b11b89-676e-7686-a074-9527ef6443ec
 17 c21c57ca-bc96-249e-a5de-d026e24084c0
 18 189e407d-e3e1-46dd-be3e-75fbacf7f246
 19 0d28d3d6-a0bc-0c54-a45f-4fdabf61c3d9
 20 f967fe56-f269-88d2-bebf-88c3d72265cf
 21 280f3c28-1ae6-07a1-a40c-13f702a380c4
 22 b025691e-185f-6f6e-aec5-01a0dc4aa981
 23 fd51209b-bd46-103e-b733-64beb07006e7
 24 b68a14ef-09e1-4cda-9c99-4503b8fbe251
 25 36f218cc-9164-85f0-8163-cfc25654397b
 26 5d4e6e20-058e-6272-a97a-32ca574ea0a3
 27 6ac70992-83e7-364e-8ba7-952cbbde2a44
 28 cc74dd45-7021-88a9-84d2-d467b07500ba
 29 61fa5393-0f9f-5f8c-b6cb-03f72dfb671a
 30 6d8a9d44-7837-4788-86d7-65b7b236c4cb
 31 36db5707-760c-7678-859c-6c070506c804
 32 31480d2f-83e3-2a05-bb94-4afb82635a76

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 21858111664244772408061486385472. Exactly this sequence comes out of new Random(717).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 8 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 32; the post has N = 32 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs