A858DE45F56D9BC9 archive

201207110609 wcjsd

explained decrypted filler

3DES(name+name) ECB, 38 GUIDs, seed 244

Metadata

Post ID
wcjsd
Title
201207110609 → 2012-07-11 06:09 on A858's clock
Posted (UTC)
2012-07-10 21:07:15
Timezone
UTC+9 · title 06:09 against posted 21:07 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
38
Filler GUID seed
new Random(244).Next(9) ✓ verified
Run
Run 15 (seed 117,733,640) (seed)
Draw
19 · predicted N = 38 ✓
Machine boot
2012-07-06 08:59–12:59 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

DADB6A6BE75B4C8E A94591527881E9D1 A639873756734D0D 21B04A033B649BDF 0732A81BE4C0137D 66FA398D32069676 30166AC40BEF6D43 4C321401718D57E4 B90A0DCFCAF45655 7990F643DFE22AC2 2CB7C2A717C7421E C3AFE02190E7A2CA 5F5A7DD5E0290E12 1AE1EB8C78800979 1E0CD2383320C646 6A2FA5C725E29B40 91331BD2D31FF519 42AD0D3B7E2862AF D658CCCB74A6D5E5 AF76593B677C0778 DC0A784392B5695C 982ED5C813A84397 3AF7DD820859A97F D17853EC85F40F1E 7607FF1C84C30398 062C7A5FEF1EA83F 0A76C89AF205DD0A 9A498215388122E3 54487392D5EB84ED B1F7A6C27C2C6257 0CA3CE8D747AB572 3D63F99879AB8CD7 8306F7122C2A6D1D 77D9AA9F2CD0C7FE 217114E249D28D21 4FE16A71FA83DD16 97A8F003FC1C6FD4 63C2286F29F6E4A0 3FAB241451157871 81530A2A13B3D8B0 ED0E73B6B066A03E 1D6E95EA54CFA462 8C0EDD87910B8BBF 4E51404E3D1242F6 17CEBBF52B67F1D0 67DE666608B912A2 27CC4029B4C288DB 7CA7DCB90DB263B9 EC4C33B6DF8B04CB E4D63BFCD0072FDB 15F2FB64180A80EC F073DE78E447F446 046A3B21CC5F8913 5A3CFE1D01757E15 502FC6EFC1249EA1 518C83734DDAC68D 03FECE0A91F59AA8 D5FD7FD52B44D42F 639C687F434A2AB3 612155ADE63587DB 10A3D8880605CE9D 53A8DC3F6FA9DB00 04091787C12B6F79 68330E6FFF3E5421 1360D8B4DC7B9CD0 BAD0C7792A93FF12 BA603B10534BDA0F AD4F229D4F20A874 B2656D1E1E2F9EDF FE779BE35F364C5B 54A678E42EE4BA05 DAE6749A2F7B6A22 B3155485DB0C312F 57CDCE8E62BCFD8E 5F1870A582D76F37 440F4EC3111A4D5E 30647F6BEA13C930 F1B80120C743A4DA FCCCA601B8F309B3 54ADE3FFB915BB8C 89502D3B679E2969 0DA8D87425F40511 7796DC61CFDAA689 A4F2C5C848011061 56D60430DCA4D132 96FA737B9BE23733 20E85548CFAAE4A7 2615C527440C5AE4 F01F420F9454BF91 D5BE4FCCB5F8FCB4 9496628036DBC104 1651790A551BADF1 F4ECF7A2D41352B3 653A2CFD0DCAF306 D59AD7B82D19684D 1D8F163958A28697 557FABA907AEC477 A7609C41B9736E2F 68C218595041B598 477C4A0E33BA53DF B9CBA36FCE5418BA 46A44E7F7239809D 79A65C382DB6547F B5F30672DDA07C5C BF2D8C4E80B669C8 3DF1F14F0E8E314A D3BA195587B02F7B 661DD30F6E91DE18 26FE839F85C95646 0F73533336FC1160 D0F63E3A993A11E8 B82A73FE68B8F214 A9F4660502125C1C BBC3712331A8D00D 65163AA2606F68C3 0CE59C1BCBC83906 761A3C2103CDFDB2 6F18E8C1867ADE2B 06723114C1163579 FBD23C4B21C1E604 F5C0196CA386E9F9 DD73EE3F0089D889 EBD3BC92C46BF2CE 7BDD6E8CF834789B 45E4174188863C7F 054C804CDF6FB8AD DBA50F0EDA9DA8D6 E82F39301674E09D 6B7C5F6904DAEDBB 7F3835186230D22B 6D6C75B7A5DD2ED7 F36EF5E3A3C16CA2 B27CAC8994B239C0 637A408D4A75340D 5AFF92B373120E49 31DCF2DD421BE243 4298D98F892750ED 927195D032E25839 AAD08122B7603A3A F8E96DDD52388AEF 833CAD1A029DBC09 57B5002049D61D21 62BDCC1EA11DE6A3 74007EE98D12763A B453DA1DACE47CA1 36904009745D553B 1DE9DE1AAAF907CE F1D0920E9D8DB348 F77EC3CC1FB666B3 E6C36138FE02A8F3 C7B38A214CFC83BF 6A643808AF32AFBA 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3a407bc9-9cdb-10be-bda7-8b27e5d71a9f
  2 0304153b-c2d0-3736-99ef-687f1c9ce9e6
  3 16c14f12-2ddc-2aa3-b4c7-3f620cfdf316
  4 5c3574be-b2bf-5d74-b538-bf4dc5912d60
  5 2843bd0f-576d-3e0c-b5ba-22ea0de75708
  6 980a7c4e-e176-78c7-8304-63cf37bb4585
  7 39f71974-66ce-2d67-83e9-59ce2ca9a633
  8 6ed12307-0fee-7de7-9df0-257fe742a4dc
  9 e9957944-4e2d-1ba3-a4ab-e1d149fc0133
 10 fc24d3ae-d264-25dd-8c44-253a86423123
 11 2b338242-9246-0104-abf7-59197afea1f0
 12 91ad5fbc-c05e-8779-8ddb-d1339ccd8692
 13 2b9224af-ec98-3cd1-a137-8470bf02fd52
 14 157b7fbe-7d90-36ad-9aa5-554b95b64e01
 15 fb11607c-2452-62ad-b373-cbc8fb9a1494
 16 69c42d48-a19e-3031-9ca6-b661a0e00a2f
 17 f43b8c29-c5a9-323d-91a6-c618ca68b42b
 18 0a433886-eb56-29a0-8569-62a9953f468c
 19 c2df4ff8-5b63-291a-8afe-4583c7988714
 20 5ea45ef1-da13-7b35-948a-cfc81bf78dc0
 21 ae42d45d-963f-2b99-b049-0ff7e0af8d51
 22 3a383cf8-2fcd-6104-918f-e1f2c8f729cc
 23 250d2cac-4ecf-2138-b7f2-a8253905dbae
 24 db2beb49-5779-2a72-ab2f-af6102fe7878
 25 65576588-54a6-5a2b-aa65-1baad0317454
 26 fef8de2b-f8ec-4ba5-9f69-593890a5393a
 27 c32c9c9c-2d7a-6003-8454-0e0684f98e6e
 28 f80d1142-2a40-7a89-b9cd-5effd20974dd
 29 8a3d2607-4c01-846b-bad2-7edc7a3ace5e
 30 34fa02d1-5d0a-58c8-b43a-8b3c5dca1ddb
 31 2be5cf45-44b6-29d9-a604-970797c1babe
 32 e0d58b70-7503-6398-aa1e-ebd2f8bbfa05
 33 4e963ecc-03b5-3d14-b2c7-e01d37af339d
 34 d8525514-b660-01ab-ac36-289e24971dd7
 35 68441045-712a-74be-961a-834e2bd619da
 36 1df3e3ee-1395-39ef-88ab-99f9ef2f85a7
 37 6af04397-5480-176f-b6e4-43bad14de50d
 38 877b160e-3baf-60ca-95bc-807ff6455d70

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 13253727120833633227262254678526307316. Exactly this sequence comes out of new Random(244).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 19 of Run 15 (seed 117,733,640): new Random(117733640), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-06 08:59–12:59).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results