A858DE45F56D9BC9 archive

201207112330 wf8ov

explained decrypted filler

3DES(name+name) ECB, 24 GUIDs, seed 2

Metadata

Post ID
wf8ov
Title
201207112330 → 2012-07-11 23:30 on A858's clock
Posted (UTC)
2012-07-12 03:27:57
Timezone
UTC−4 · title 23:30 against posted 03:27 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
24
Filler GUID seed
new Random(2).Next(9) ✓ verified
Run
Run 17 (seed 38,757,453) (seed)
Draw
0 · predicted N = 24 ✓
Machine boot
before 2012-07-11 16:41 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

4763E91BD813BFD7 C8911DD7DA37753F C15974C3ED3B14CD 84DC1843FB5A9A88 2583C9C5D6262CFA 8D67B3C19DBEE7C0 7C6E12CB8BF61E9C DE0A6A82936CC6B8 5C4B8DF79F2381A8 EF9EE7E2218B421D A8A5EB6975ACA3FB F67D26CFDE6FCECA 96CE8216EFD17355 CDE04E461286982B A3FE7DD64522C897 6A29007E19A3E4B6 93B0745A7517B382 FCF8B66EB72D2304 AF4F1B5340436CAA D6428246FC6C6FA0 F389EAE5E346F657 ADD87A9AC9073638 5452D546BEEFCD8C 5C76F267241ED8E5 43A9B3FD3A35ADE6 A163634D28A213B2 E59C289BB1A51059 505EE4D1A5F3602E 735B3D535655F0AC DFDD95C3B9DBEA4E 8FE2DDDBCC0DC1D7 A86B58F791BE224A CFC0556A31692685 275F7493E927B9B2 0CFE29A36E0F6A9E 94A7F26791277BCE 02BA8D8388E37D57 428B07F864E9DBB6 7824067D0EB1C534 137BAF81D6E98AE1 9CD71F888EE9740F E3576109F2C5F7C7 8FFA24305C90C55E 872341EBA9C5C602 1DEA232697EC9A0D 18B9F980FCB8DC1D CAE0125DA51CF353 406B7C5652000B2E 3D9905E4F8009E0C BAE23AE75912464A 2448BB520C9A93AA FFD12AE7265DB6CC 2C1BF7456A2A1A92 BB86DC7A78A7D001 B61F249A9F31C386 F71E9D7DDF806187 C46A23237D45AFD4 A303585CBE444160 DDD9D55E67138FAE 7A83CEC66E94AC43 2695B3E040A4251E 7CEAF2718CA9C56D 5C2E79A85AF382C5 DAAB14DBDFD315C2 48EE6F6B82397A44 66D96B03FA084084 F047FA9E3BE0EDF8 380667C4BE6E4249 BE34C7AB7F2E4501 BEC73899709F268A C7D11FD73F491331 AA2BD155E9B2CB7A 72613EB90D8126D9 1B4C93732DC94564 723E73D52E67EA40 EFE6A4BE37412D0E F955877A5A1BE0BF 34A72A5DE0577CA8 DFC715E33D576067 BD62583E1F885D6A 59F5E23DEF2CC590 52492DB6FE455650 E9C72EFD40DC5FDB 82307EA943FC353E F4B9A25C29085EF0 5C98FEC4346B6BDC 690D4AF5E1FDC3CD 31E20301F3DB0343 DEFAE193DB5C1779 540EB8A867DD9548 F746C95AB98D59E3 DD379EB19D543033 022B82C8DB7B30B8 F8D4D7EE66A1466A 2E6E84B6DFFBF0C6 04C4CDBF9FCD839B 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f15a6a72-9110-6777-bd0d-4df3681b1868
  2 9f87a6a4-9cc2-3137-bedb-7fe1dc6de239
  3 8f18becb-48b5-1694-87c7-06fd2bb0af60
  4 b42b4943-00c7-8a46-9036-b33214541955
  5 5a51bdad-44ab-0709-bffc-9a037c1a2bbc
  6 044b3657-adf6-2401-8649-231a398842e4
  7 16f65344-00b9-72da-871b-99e68dacbbb8
  8 60b6fbca-530d-4823-bd93-6042bd95c5d8
  9 b93ca131-c17c-21a9-86ed-a59c9867bd80
 10 10c933c7-5a09-0f83-9dba-64f3d2323b50
 11 9840ae9b-a009-6fdc-9c80-c944fea4c422
 12 e9932d6a-b42b-0c22-98c8-58eaee1aeb13
 13 c2ef08ef-7dad-01fb-ba55-5ca6c8ce5a58
 14 85ec016f-4138-459a-9d7a-0d031b3bbcfb
 15 2350c155-2f60-3b50-a334-39fdc54e25f7
 16 adf163b7-f913-2eaa-ab62-6d6ad3959153
 17 3614c1fa-0f4a-6d7a-bcb4-f8165a92537e
 18 c066be1e-cf44-29ea-9507-3daa95b4e855
 19 eb983160-3880-6d89-b56f-6a203fbb5668
 20 637b1fb0-d733-0cb1-ba8d-1c77f5167d66
 21 36a5bb1f-9bc5-0970-b00f-fddd5b21bf5f
 22 3d2f2fb0-02c4-31c3-a29c-b32fffd4e713
 23 b83527b8-8abf-28c4-a23c-5f5ed407cd32
 24 a6af3a5e-e550-633f-a37a-bee706cbe00f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 631802742060043262600326. Exactly this sequence comes out of new Random(2).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 0 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results