A858DE45F56D9BC9 archive

201207081743 w8kbe

explained decrypted filler

seed 422

Metadata

Post ID
w8kbe
Title
201207081743 → 2012-07-08 17:43 on A858's clock
Posted (UTC)
2012-07-08 21:41:43
Timezone
UTC−4 · title 17:43 against posted 21:41 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,872 hex characters · 936 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
29
Filler GUID seed
new Random(422).Next(9) ✓ verified
Run
Run 14 (seed 205,976,312) (seed)
Draw
10 · predicted N = 29 ✓
Machine boot
2012-07-05 08:28–12:28 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

38131B4BC074152E 8431F855716BE82E 7D1694A3BE73EF16 55A4149BF168DDDE D07C803867A836EF E9E065612B36A2EC CA4FB83390621168 F4ECE1268FD6B9D1 B32822267B501221 9A2259CF4CD20596 499003766F4D3322 8E426406E4561F77 676625D7B48D3C61 41A7607D3C581428 6D0F6042214C5184 FBE81D68FE3059EE 93DDE5509EBEAF23 62EE97B76B82E6AD E220B2290DF175A4 46CE832273A87B0A 6E31C4BAB157609E 6DBCFD7B5A7F74EA 0877544AD881C60C C6AC822D054A59FE 497EFF6FAEF0999E 5501AB0F397CA7F3 CE37907010DE3F83 C7615148950ADD92 767B11F37AC825A9 6048EB526788FC75 1BC570ACA72C86DC 665D43B724227CE1 142F88A53B5C4523 A37943FED68AD265 AC1DA1C4ACEF7A24 2A6180C677A0979A FCBD8551664B4651 81816FE2F252E8B1 9721A005A486FA45 96180DA14329E289 9F5F4FA6AD6DD270 6645D8F3461B5EB7 306DDC0CB45A5486 4B0DA45B6C80D26A DF5E345655CC293E 57C0DC33DCAE517D 1247704C9F73A562 B3D357ED0A68612E AB84FFB065ADEF07 74D75D854A64D700 9885F555F5B6DDE6 D282D0735E3800F6 47E5694B1A05C384 7EE741C3E1E3812E C7761A6D66965C10 6E41C532F7901F66 B5AADB72318CF8D8 2407A6D934A095C6 A963B7B8BA67C093 AF0F1D9373771D75 5DDDDDF6A76B4D61 0CFE4660C1564526 02175E6E1D0A44EB D98154617A228716 3C57E5D57C04FFCE 2B26CD534501AD6A 4DF6B31EE40248BD 74C81D6A0F4FA6D0 0C77225E88E92905 E9A5375A13B2A385 36A9735CF0742F39 0242F64A8D022AA0 C313A1E0FD113D15 6AA6438E3CE7FC4C A9B85B70486FF4DF CFD897C4B9E2AC04 C82FDA16A3F0163B 1FCF9840DFB0FA79 237A3D65F89FE94A E7395D1CF47CB020 FDC2B55909FF0672 97F6C3663832C2B1 A4647BC4411936F6 F4A7093A9FDB7B59 57EFE18D6523CF96 9FEC9EE92D4C1C91 799D6661C0E105C9 FD0DDBE7FCF8BD12 E459450627DE1739 3E1BF16DC6D18DED 8493EEB2A2A2AB6E 919CD800D5F517BF 2521005E74AE8275 C1F655F6BED51EBA AD999048BD6C450E 2820E7796DF6171A 3DC66604B3ACEE82 3CF84D73614654E7 1308D39241B43165 CD6D8E2EF18A2AF0 71EA2D69D21B4289 F4303F8F5155B243 DF55DD632BE654F4 7D050AD2DF49AED8 A98D220EBCDD8E49 E66B3C5C287DE685 EEFA0C126970CE43 AAACF36F8C43AF30 2C4F2C21DE8AEF69 1C712EC2C7D62F8F 00703F06CDAE6F6A D8F756DA1651BDE3 6FACBEAAE22296CE A57C794B040AF4F1 443B0959793FF45C 85E7A76FFA185F3B 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,872 hex characters = 936 bytes = 117 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 29 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3482034a-9dae-10e7-9845-e8d017d887c5
  2 1d24f495-ea06-56d5-a7aa-5436ed82796e
  3 0de977d5-4aa2-62ae-a910-b9bbdff21c15
  4 3eed8e42-6d8d-5db4-9bab-8717c9ffe2e2
  5 cb962df0-e9aa-6b97-af34-386d3ed6c76b
  6 e1a750d3-9675-3ac6-baa9-7155b6a7abb2
  7 6b23f075-5c59-8b35-9b0b-61337fc2f32b
  8 2943b1dc-a4f3-1adf-a91d-6ac71ea490de
  9 4d93c96b-4db8-153b-ae4f-2fade5d40a33
 10 1aa6814f-45e3-7d0e-8ad1-a41dc4b36af5
 11 479b8799-30b5-1c3e-87d7-9e9c757a3806
 12 bdf6c272-e211-8b86-aafd-af0c969c99ba
 13 d57b7aa3-c2d4-6a2c-b505-31b9f072e3bd
 14 e205a84a-4c1e-0403-9a6f-449e351f1af8
 15 0f3d84ec-be23-347e-973e-468bc165cede
 16 a92e55ea-7694-5d25-a52d-b8d71870f6b0
 17 597bde27-c865-2019-ad0e-b8e27e5c864b
 18 a2d12244-daa3-555c-bc9e-08e36c106813
 19 023df35a-b166-06d9-91a4-127118f461a3
 20 2c03b9cd-78ce-6c76-87ad-901de851b5b7
 21 0b79bb47-759c-75eb-9374-da5cea9848ba
 22 bbe75429-c009-3ff3-8284-8305c388d34e
 23 98493a89-276c-2f62-864c-0af381a65719
 24 502b7ac8-1ee7-48f9-bb5e-9a89c21b0d44
 25 1baaf617-4a42-0a2b-9d38-c0f75965ae36
 26 82554e73-6f3e-84c5-a014-85922359e7ae
 27 3edd9ae8-ec3b-6d67-b26a-2855ccc51f00
 28 4c815c05-40c6-1222-9adc-9c14e898de68
 29 d57258ca-1c9b-0611-9525-01a51d2c19c3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 15656381171860352506732408610. Exactly this sequence comes out of new Random(422).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 10 of Run 14 (seed 205,976,312): new Random(205976312), Next(8,64) per post. The RNG predicts N = 29; the post has N = 29 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 08:28–12:28).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs