A858DE45F56D9BC9 archive

201207101435 wbbvb

explained decrypted filler

seed 618

Metadata

Post ID
wbbvb
Title
201207101435 → 2012-07-10 14:35 on A858's clock
Posted (UTC)
2012-07-10 05:33:45
Timezone
UTC+9 · title 14:35 against posted 05:33 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,512 hex characters · 1,256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
39
Filler GUID seed
new Random(618).Next(9) ✓ verified
Run
Run 15 (seed 117,733,640) (seed)
Draw
17 · predicted N = 39 ✓
Machine boot
2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

EB51B9E01CC56531 7FA6AEE03F7964B8 B81D7772A61DF838 2BD5E6464FDD6447 06CBCC795E064EBE 68566803F4D8012C C7376F23B05BB998 FBF73A93B53DC58F 67CEE479B34A941C 6EFCB97417DE4A7B 4CF25E6DA9694AC7 D63B9DC1BB44EFAC BBD8F3CAC58BFF04 94192D8B8D817B24 096A6FB7986D2ACB DF36573F89F1180D 991232BFC9357713 F73960EFC914860A 3BA6DA6805E5A2E2 F33519A92FC3196D E91301A6EA3DBABD C19CB8D704275BBE DEC2A9B88994BA0A F828E1AC8CC525CA 94F364468BE104E3 C7ABCFF983CDCFC7 1BE46AC8B3E2579E C5319AC921F24B0A 70AAB01AADA02ED9 78984E2DC76E0F1D 4C8E3C57E5F988DD 66D3C594FAEEDAA6 3B70AE96338DF4A4 71FA87033BED888D 96F82CA59E225729 E1C60D74E82930F8 BAF33D32BA0B997D 7C04EFED6C7D4F28 D31D31902890582B 40E281F3EC6BDDD7 3DC9F3C41B8CCDCA 692B53E276689754 A29063B93C7D940E EBAA728B10A9D737 AEF826708EA69D07 AC6E00202F69886E 3C60EA2A61F75DF6 07611EAC6D823D78 56CB016F0D7C4D1A 13542B732A6A5407 6C85681106AB01CC 8DCCFB2F560C386B 77CF84DAABBD4D39 9D48B06A4FEE654A 5D82DD69F1346431 AACDB51D9704BDDE B133DD4C012511D5 AE584098C147A333 77B538E8A18C4EAC E5C156572DB7650A 02FFD1621E1EF920 B02F82B8490A99F9 720ADBCFEF7521BF 467FACAFD658C9B3 E8BFEE8782CA3A7D 4A5027A99AB98915 325DF31C9B76FB91 C12091E155F54065 1AB8CB1B883224A5 AC7FC2AD25674643 08577541151E5223 3AA4054529ACCB77 155FA1619107C96D 700E79EC91351A6B 2A5FD3B95C511A13 4EE2E3547463B136 A6945A9F09684222 18DD1BB71CC75D53 49EE0CC24E6668E8 3D5926138FDD5BFE A8C22EF0E5B4DA31 BFA0C07452408BE7 8AACE4FE96203585 DBABE8074DD97E0E 49C214730CDCE3A5 0182D1A5B41A7096 DEBC73284AEF4738 EE1250502552EC7A 56952930DCF1E052 D9C339BE05D9C616 208452D2797D79CC DA48F42BC4078E2A 2734B740A7ED4539 FCD9AB83E91852AF 4AAC74613D42E3E3 AF59E2E337E8B3B6 735C02E7F2066DB9 64DD5CF93F4AEAD1 BAAC2DA194F7887B 278F72A09147E9B7 1F5A24CE120828B3 9F261707991A0EE3 D89E9EBC46B56085 310F6D624F99B109 5A3718C4B856ACDD 7A82E0F35014B0AA EC8634641DA2BB1B 84E5AA721A87D784 24EEE2E0FC82B1DC 712808B2D6B4A70C 796781901D74A76E 327B51E32BB61394 9F1D85ECF1C6F36D 61E8AE0ED8926023 099915BF8B25CDB5 2726DF246A77F4F1 49A19AC4CA9A9E39 FE29B80D517590FE D95DE828F5F110EA 47C388A5FE2ED522 97E6242EAFA20D56 E02289D99A97A637 94EDB156F7AAD951 E4E25CE9E11D9C18 3AE4881DE45D4A55 27EB93546BC63287 947F909E88D93C54 B779C65B08B138DE 5EAAB591365976D7 356ADCDAE75C4A89 D3281BF145AC3024 3CBF36231283B9D8 986EB4786BE8EFD6 27B7FC7F43D14540 A58EFF06342033DF 537943E61C3EA9A2 73F4D22F19E8AA19 668C4A4356D77B19 983D2BC227C32F62 A0ECB45BED13B60F 9CD4B4C36BF4C34E 196B1C98F133A90A DCD2CCF9296DDEC6 96EC373B9AF0570F 565C9A58002CE9CB 09112ED08420147D FFBFB207987FCF39 B7E36C99264EA402 A89BE6D216B80F14 250DEC86F6E15C43 50A28131237CB742 FDD21A560CE3F735 7AD6D653D6645390 1CD1052B87CBDEA6 42F4D8CC6472EEAE 878FC11AE0A76324 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7aac8a79-758d-530b-8169-5099c788a0fa
  2 c83fdf19-44d4-18bb-960a-d918b6b49240
  3 f7acd6bf-39b7-6809-91e5-2824bbeb6c2b
  4 7056e586-5606-4592-8eb2-c6226d973fb8
  5 8db839c7-a815-208b-9e3b-ae394ed56af1
  6 4fed0bd4-aa20-52f7-a5f9-349aa6309e44
  7 2637065d-d8df-7c1c-841b-1fd8a9e95194
  8 a167ac60-7756-44e7-9907-a4db02e06361
  9 4dd47203-cac3-30dc-b403-f5c0646c4725
 10 6c64c403-fd1f-1d1a-a609-c660d1c7b551
 11 fd41d2fa-39b8-5c03-8fcf-423933a7bd8e
 12 ae4ec45b-a6e8-89fa-9d73-1348a191e906
 13 5e0c5b82-3a4b-41d1-973b-9b63a6ede69f
 14 2390c2fd-6903-8b2e-8981-5fe440a4bd81
 15 81f5934d-3e02-5dd9-a02b-67a96eaf40f9
 16 e0a0fdbf-053a-86b9-b60c-c358013c2691
 17 07757cd2-dc66-5292-b153-fffb458104ad
 18 a46a7481-db77-1815-83dc-dcd25ecaab80
 19 eb882341-d76d-3516-8d3e-e5219baed742
 20 acd52cd2-c956-5b1f-b863-fdf7d2766188
 21 5a946f8e-e744-82b9-8fcc-67383086c697
 22 678c06e0-e62f-4368-9dad-747586f56871
 23 02551a3b-bb94-3e3c-ac67-21225f565636
 24 6f3edb74-74e1-8e97-bcd6-f47c77bbce70
 25 da752abd-71f7-22ef-8ddd-3d112bd4731b
 26 beae675c-4d4c-0a1b-9bb1-286ddde06ff5
 27 824350ff-279c-208b-8640-093c0c1a7c69
 28 aba7f62f-5df8-5bef-aebb-f86c40d44e38
 29 8104e25e-9123-2e44-977c-894249826361
 30 c408eb50-14d2-7663-8b4c-67a853d8b4d4
 31 7b2ec5e0-cc99-3954-a8b7-ab75a6e90f24
 32 732a5221-15fe-2923-9e08-462c38a01fd8
 33 cd57723b-9d6b-7c9b-9902-db08c87a262d
 34 1593d127-6d3b-443b-be39-fb98036ca2d4
 35 fe3c72c7-e69f-38f3-bb0a-70ce2c1ed817
 36 124859b1-a913-44e3-84f7-7f5899e4ad2d
 37 d10f052d-a9cd-8a9d-be7c-82a9a22fa07e
 38 7f2937e1-e10c-4279-acfa-eb34b2df1397
 39 66232ce0-7dee-1b72-ae23-855f658361b1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 516425743158485851358438202527327434841. Exactly this sequence comes out of new Random(618).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 17 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs