A858DE45F56D9BC9 archive

201207100644 wajfq

explained decrypted filler

seed 925

Metadata

Post ID
wajfq
Title
201207100644 → 2012-07-10 06:44 on A858's clock
Posted (UTC)
2012-07-09 21:42:11
Timezone
UTC+9 · title 06:44 against posted 21:42 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
24
Filler GUID seed
new Random(925).Next(9) ✓ verified
Run
Run 15 (seed 117,733,640) (seed)
Draw
16 · predicted N = 24 ✓
Machine boot
2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

0D3D25B0B410D898 404F30ACFFBE4826 D7E280081B42A659 DED6E349B1B238EC 77A8C8C72DB50B29 71317119DD809D59 9336AB28D7F75F4C D0E1A44AEB9C132F 5C1346A554B4CDC8 DDCEB81498C62187 0D07F800F8C2CF72 547F0985DE330666 B83A5552EF59C343 CBFDC577383EF176 61731B4EE56139A0 9589639220B64F72 DA81040CF1960D39 AD2378D18095FAEB 3CEC364A06FC9721 5E98F3B35E4D122B 86DA197AFA59F358 FAD26FF67B241FCB BB611E66295D86CA 1AC5938A53534218 504D116FD8D4D4C2 AFB2329353F392E1 B741E8ED4EF7BC58 37285D4AB549E2A5 8EDA0288AFD7790D EEE7F21DB448400B 5F1A8132A0874F75 B19D34A43876551B 1B5A4BEED765E878 3FDFAB76489E1585 DE18DE9F8FEC5F22 778F28F3EA0D439E 9DA4B1815C27FD52 19B285C0E2C34B48 F637CC09A13AC89E 1EF55AFF64111FD2 F0FE53AD99C72186 BAA25AA35D7A3AD7 C514DFDD0D03D90D 408EE47BBBC33458 298D970C14D685DD F0D7FC190C12D5B3 5A3D20CDF20E64EB DECFD674C6F5ED2C A1A5AF4A2A829FBC B01FCCACA02E9818 BB1EE0A5559E5080 32CF72D34AFA4569 E4826C65145284E7 9D6BB06EDB5B2F20 6A939204D57E6E54 16417359797594F7 BCB31CB4922B6DAA F82E67A65783526C 95CE5BB83EC92C38 F3CDE4DF185E53A7 5DC43A51BD59E725 08AD757F3E3B1E83 C8F2BA9DEE324CE8 4F8AE2FBEFE2B97A 85FE9FBCF63136D1 26FB83BEDB1FDF25 776E370E399D2030 6D75A8AE7799EC78 395A2FC32D889D11 EF069D606CDA9D17 9918B1D424F241C5 A68445D8A123FE7A 552E17FED879E529 813BBE1DCEB48AA7 61207F91FCE46BE7 0694B967B1B2E893 AA2F12E821733CFD 698DFC444219CC45 E7960C02925AD7B7 A39361B768D7A921 2181357CAD56ECFD FA3837E353CE0B0E 8DC1F34AB2C0C2AB 3F86A678AC61F365 7A8155133AA25A45 E526E94CE85FFE46 82765247ABFBAA3D 02D9C4805A40F1ED B9D58FCE122A63A2 982EE75F91289993 7C74D41465F3E212 0615D4B98A95523C B1F4630F99FB50FA 06E0E87696899081 1C821F19F600FF19 98A65798FF290832 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 53d82fca-b95a-8ca4-9013-0215e897c809
  2 fecc9e81-04c6-2bfb-918e-21ce7296f319
  3 528af52e-1304-2da8-b8a1-e0f068cf8bac
  4 1f7dca1c-b445-8cf9-bc86-dd4ff09f4981
  5 fb1a371b-dc2b-7a34-95a2-25e0cd138ecc
  6 31c4a077-301f-82c1-a4f8-74b26504e51e
  7 9b154e5d-0d38-3fe0-a851-684fb48b7827
  8 5a1d142e-ea16-44ac-82ef-fdb8c3413b37
  9 22cc492f-d9fb-3e15-84b4-63190cd0e34f
 10 85d35c4c-1f51-3f93-bc74-6bb17e78c721
 11 959140bf-fe1a-6b4f-8b78-1410416f7640
 12 81543460-1f8a-5578-9939-fc59cd350387
 13 c8e538b8-03bf-4ad0-b080-2119c823ac35
 14 d2b83986-0fcb-692a-86a4-62ee34c82e1c
 15 24ad931b-dd24-41dc-b216-46515bd256c6
 16 5aa5ce6e-d4f7-6b3b-9a73-1d7a8ca19782
 17 1c4b5eef-5e66-6868-856c-48f20f419344
 18 d5b25be3-c95e-408a-b9df-bc6dd8b0adf6
 19 79719b05-24b9-6ab8-90d3-ed079a39e2bc
 20 21043249-aa19-4499-88e8-2447350455cc
 21 d113c83e-e1ba-638f-819a-dd99c036af6e
 22 3e09df03-99cb-73c1-a692-604af7183d4c
 23 d5f966a4-3e96-2f0f-b94d-fa2765d8f7bc
 24 050b2e42-ba93-1ac5-a810-2d71e243f3d1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 822878343365464664646721. Exactly this sequence comes out of new Random(925).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 16 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs