A858DE45F56D9BC9 archive

201207132330 wj8zg

explained decrypted filler

seed 470

Metadata

Post ID
wj8zg
Title
201207132330 → 2012-07-13 23:30 on A858's clock
Posted (UTC)
2012-07-14 03:27:58
Timezone
UTC−4 · title 23:30 against posted 03:27 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
38
Filler GUID seed
new Random(470).Next(9) ✓ verified
Run
Run 17 (seed 38,757,453) (seed)
Draw
4 · predicted N = 38 ✓
Machine boot
before 2012-07-11 16:41 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
10 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

4045A827B044B16F 3A37773A02A1416C 7E869711DFD78327 0406F01F096351E1 CD81D9567D964095 C6ACEA81DF43610A 1168C9F7B505788C 3557CA9653BCDFE1 58D16964820ADB94 FA1D6A9BDC7A2830 60B316C40046308E 9B59EE5B30F29D0E 1B7F9E5ECE6C9E08 53F70106AA03901A DED375293D7A96FD AFDB8CF18F8E18E1 C89927168ACC624A 49BA61CA770C57B6 5BD203D8BAB866F7 374E32D3A4139C13 59837446F56D1003 67955B5A94A4ED69 1E39CE0542A2AB3A 98A9C5C216FF28A6 6E69E3931A15BB5F 428A638E777AA421 BE8483A737099A50 83B269B7668886A3 1AB2283C3006074A 54052085935B73AF B2FFB8D47920F54D B8B29F1F1BA44B0B E2D095C67105B1D8 54573F41E26FDA39 3B3D5EDCFA9E03E7 66839820E98A0818 3ECEBD06DD643F20 87BE16BF2511C7D3 E1BCE4756CF4F1C1 1AC3AF8C55B93766 89AC99416FEEAE2B 99F813D79FD6E9E4 F237E28A030C11B3 5DE1A3D3D12197A3 0C146C521D0ECC43 16E8E62C71156E7B 975E3030C5EB6AF9 E70F5244693B13B9 549632BEB3CE9C18 02F9231112DFD6DB 2C7724F09C60A95C 1186C2417F503963 A5EC8A1399DEAC40 2BAC4A1FF2F0B280 A091444A584B54A5 BE23FB268CDF5624 63A11711D3E6ADD2 74D091E3C911904F 551B7A7EEA7D1A9E 9174D6AD826CCF40 A4F79CD94ABD58E8 7FD9B680F576101A 4D97AA67D0ACBCFE 86EAD0BEE0035331 C3D860A1DFD8D63F 5CBD305A47BFCEEE 59249DC4385E754F 2E6295D667D6A627 9C0F99F3E5F4AA0C 4CF4C3CEA075AF9A E57265B6D4771159 ED47CB24218C0253 E4E518B8D7C8B9FA 6C2A098CD7E3CD0F 8346E20ADCA70D80 D4D4B2E17F25D45E 85398115ADA5FAF7 BE6D79E145CAF7B6 41C02B1EAA8D7C15 DE1CAEE7D950B2E5 27CDE1C6374A5774 8C15CB1FA4D6AE47 3BD5D90BECA52A90 C4B7D939BE1B54BF 4191A31C351F8DDA 4E8063182EAC6B1A CAC47C05A2A8E612 08CE28BAC93B627F 332D7868E0DD7C2E 641C583E262F7237 00A2CE7CF18101D1 EBE35191B3A22E90 7B9A635531336FA3 27EB201C8CA94145 27B3B1736BA166C6 80836EAD606DEA3F 0208C8479B940000 7B95F23FBABB7310 623AE0A918C9609D F1CAB7C6A1A77E50 D037B9107F13BA29 216041E0F8C1216C 3AB687B39C6DF78B 63AA0A70110E5A04 CC89981828874ADA A7C3742DE9470B5A 98C425D04E1556CF FCAC0F243B475D9D 232602FA700D7321 62C11D736A4AC219 BB9EB9C1F886AB29 DBB09DF84FC22B47 CEC65773EC68583C BFCA431B91411A51 BE27691686D2DAA8 ACE6CEAA1F872E52 92F26795156C8FE9 30F76954CED020AD 06937C822F5816D8 78B3F4125875645C 6427FAEC6D684693 FFD9D8DC2446032C 65626BB00402EC2C 03B09D276058AB09 424A485951A73EE3 4C1F43CA4BDD6E34 19FE64D1FF583ACE 88581E1765950254 68A51966F51DD37C 039BE16AA9E2E115 3013631EE1CF4DAD 9B96DE9B7CEDBA30 FE9B69E2EE7B13CC 4B21260A3567BF7E B77C1F801954ED18 2963517A9D080531 CE5237EF845253E8 3365F7DC4BC947EB 09125B0D088E3D56 D3D77B2D848961ED 2799C73E342A08BB 11075A1C11C77CD2 C84AD35F8F3A6F91 92AC6C9440C75998 5F9F86C6200C0A0B 6BD95DF1C50D052B 00344C85AB2499BC 53DAD54546DD9BC5 D5C27D5F8E26E609 45D322B09381C4CA 9392DC5D3AF4987A E1E0756A2CB431F9 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 876a4950-fe44-2749-8916-c6cbfb9c2243
  2 1d671d74-5b75-65d7-bc0c-bed4aac5cc09
  3 7aa46163-0ea1-24c0-8e85-792a122dab4c
  4 4c308c7f-2fff-7b97-9bc3-dfe5d8794df5
  5 d525b8ea-817e-38ae-8872-d50cfd9d3341
  6 74e236b1-3b03-23d4-90cd-c92e2909ecc9
  7 118e821d-4049-4a28-9072-0858dca8eeec
  8 549f0509-a8b6-28c1-a3fa-7af189401ed9
  9 5bccdb28-2cd9-1fc0-9860-a1149a353b38
 10 4e473302-b2e7-5b89-ab5d-5274e2deff6f
 11 5e44d997-4112-43b1-b948-40052c4a2726
 12 35bf29be-68a3-39fd-8d44-930fc149e118
 13 2aa1009e-5676-6a20-b6e4-ab0808b01917
 14 af64c6f3-e3f5-8c5a-885b-e34d1fefe629
 15 e1b2670b-04cf-83cb-9ceb-68f5dcf91b37
 16 5f4c6ac8-aea8-4c66-b710-1acd43584d7d
 17 05837d7a-e7a5-30e3-8068-28472b4ba0f9
 18 f2ed7e2f-3676-3d8f-bcf4-7747f2104c85
 19 0dfbf26d-c5a6-3f33-976b-9c80dc883473
 20 eeed3679-c72e-2cf0-a0e8-90596afe6f45
 21 fd617d93-3eff-26ed-851b-ed722240ea67
 22 13f07e8e-c057-12ad-9705-a16e42ba4e5f
 23 288ca45f-62ec-3335-aaa8-ae916cc1b8d4
 24 72cc8c74-2abe-2252-a60c-2efe85efa8ce
 25 9e25e2e9-62e0-64b9-b833-62ea41829355
 26 60724b45-9d12-7aa7-a28c-8f16015724ad
 27 e8840b5f-1e70-0735-b20f-206ebbd13576
 28 325ef0a2-0553-8e62-b6f4-7a38d4a1c1a7
 29 92e5f357-bff4-39f5-abf5-719693ee38f2
 30 f2069141-6859-5be0-858b-1d1dc83c7fb3
 31 9afd6aa1-0919-6d44-8b06-5d00604e9c78
 32 d0f4f01d-763c-2fcc-86d5-dc21ac49db5b
 33 08af6247-5a16-25e8-a46d-f61677232b5d
 34 b6c40f57-c625-6e12-af1b-c79a19bcd8e3
 35 c79df253-5fbc-6f28-aa97-8182f45021a6
 36 85589e1c-a0fe-1fad-a0e5-c02221b760a9
 37 6ea5ff0c-5be6-3c41-82e5-dd0d72971acc
 38 8e49c425-df5e-6e40-8455-f225a518170e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 26273242154368843332213267083562266136. Exactly this sequence comes out of new Random(470).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 4 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs