A858DE45F56D9BC9 archive

201207110055 wdc2k

explained decrypted filler

seed 376

Metadata

Post ID
wdc2k
Title
201207110055 → 2012-07-11 00:55 on A858's clock
Posted (UTC)
2012-07-11 04:53:42
Timezone
UTC−4 · title 00:55 against posted 04:53 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,424 hex characters · 712 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
22
Filler GUID seed
new Random(376).Next(9) ✓ verified
Run
Run 14 (seed 205,976,312) (seed)
Draw
20 · predicted N = 22 ✓
Machine boot
2012-07-05 08:28–12:28 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

73E6B49CA8BD37A9 7B91FF552CDCC23D F2C77913A75ED479 69FB03EEDBF9767C 837A7CFE8B153343 D53DA2C878205B3A 5A3BD1A099140EA4 9BC9CE8871180B30 B093623CF681E0AF 0304DA2F6E646AFE 38817B52D9D523DD 28B696820DFDB1C1 347491AC264FBB16 5B3FB1E53B170BCE 0CF59F5510EF511E BBC64C04B8DA596F A74F848DD609FBF0 444AFE06658CD358 2C1BED656903D95C D8E5E3547DE27A4F 0DBE5392FB15E137 EC02033F6AA6DD70 410E4AC2FDCB2672 9FA7D172A0F5DA98 0DDB2C091A8D1C2E F93E4A900C817D86 B57E84DFFF31706B DA962E72DF4AB51F 3B385BF94FC5BF9F F1478E9963F95D8F D9BDDF9C0D191169 DA30C49E7D2EC4A0 5D02C06DEDF5EF32 6DB166F154D413C2 420F0354928F94B5 BE809CD4B5570FB4 6873ECB86C702B3C EEB1EE4E88E9C828 9367691C3E165E9E 83904DDF57A453AB B450117E33E225D7 425964290B5585FC D8BA51A8D1C48A1E 25127FD7EB9C698F 5707A070EAF41FA8 E2CFF8A3E5EE0906 FFEB8DD9638A4391 04D4608BC988D40C 4392A8F72FA6379B 7A645D7F6D4FFCFE 56B116991776B896 D6CE778A7F72BE1A 71C5F825B193E5B0 577A6EE805F05601 2FD4BE2D55E578D7 97DF561EA6B9443E 068563D640124E13 DA842052759FF4D8 25945CB88A98A58A D5630CEF02808BD9 1087BB94CCAEC48F 1523510A33EEC9BD BD6FA6FDBBEC2C3D 1D954401E19FCC02 372DC14B6411A672 7E2716E4BB9B9342 982A666D2702CC6E 83A270DC5D88A71A FD54E72F4E80C427 4CEE92BC94211323 6E5B8FD503E75E2F C1B43E9BB1AE97BB 08A868EDA90F4ABD A3D870DC178D9934 5B38E2693646AEF2 634025D088057DA2 1FC64FB1F03D0057 329FE1149B0F9FEA 9329EF415114B433 F672391E28BB9E94 5A415B4F50A7DF88 6E732AF4EAEE4C7E CD64BA3B6C6A7CF6 79184C90E4F486A2 3DFE0E5BEF426765 E2BA1C6DC5793410 3A1A5AC2E60D9B7C 461808C2272872BC 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8ab8e379-c4f3-1e48-aa51-553dd6e01dfa
  2 08830064-ffcd-1e2b-b261-55cedde37528
  3 42c7b044-af91-5e5e-ac22-c8b3ac9ed002
  4 d491386e-9ec3-7540-b38e-30a024019d4d
  5 6cc16ad9-8f18-827d-a36d-c6e032fb6c55
  6 8e60782f-f5f2-1926-8287-628a1791f090
  7 62a23d6d-d500-3d29-bcb4-437de336f309
  8 a4c8ac4e-df7a-0567-a4d2-33935153a469
  9 6ee56bd1-3494-49f9-b73a-4faff4c4e58d
 10 265c62fc-e887-8d7b-a890-13438b98b1b5
 11 40b2f6c1-cc1f-2ac2-9d03-dad06ed03401
 12 fb8d892c-b26e-079c-86f4-98d50fa5cab7
 13 a2857c06-c898-18ad-817f-4b1dc7272703
 14 9f9a1a52-e53a-0629-8ef6-c741c0962adc
 15 12dda4c2-27ca-1c31-8edc-641325603e82
 16 42fb7a9c-f5aa-73dd-91bb-eff7015aff83
 17 5c9068cc-c8bf-8552-b74c-b6e1818545a5
 18 bae16724-e785-1818-8ef3-65169fd38131
 19 9f82e863-7625-7b81-8541-10f945d141c1
 20 c6c679b2-c99a-88e7-a578-4ea790c2c6b5
 21 fd67b8d6-2860-641c-97a1-a159ba7e8649
 22 1068a2e6-81cd-0199-8dd8-35e6c5f70a99

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1157813048201017817860. Exactly this sequence comes out of new Random(376).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 20 of Run 14 (seed 205,976,312): new Random(205976312), Next(8,64) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-05 08:28–12:28).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs