A858DE45F56D9BC9 archive

201207142330 wktr8

explained decrypted filler

seed 689

Metadata

Post ID
wktr8
Title
201207142330 → 2012-07-14 23:30 on A858's clock
Posted (UTC)
2012-07-15 03:28:02
Timezone
UTC−4 · title 23:30 against posted 03:28 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
25
Filler GUID seed
new Random(689).Next(9) ✓ verified
Run
Run 17 (seed 38,757,453) (seed)
Draw
6 · predicted N = 25 ✓
Machine boot
before 2012-07-11 16:41 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

AAE4C53EDA1CFADD 76D22E8795559BFB E246ED0B9EABF07F 58DC12BCED0A664A 66CA9B51E34FF3B7 BD23E4261E0CED5C 671487E6D4332210 2DF0C4CBED2E807F 92B30B5496B39889 19FA4CE5FE53C021 F73EE675A250A834 EFE340B21095E032 2B384CF70D6E33CA 602DC3F29318393D 6FECF05C86845A03 C4B27E71FE7921C7 7E2E83500D7A3C5B 5A1B87788A3333C2 01BA5AE01D742BB4 F9E074D41DC51C9B E1DC7D3CB45FFCDB B1AF5A49E7114828 0423172615CCF2F5 6ADCBACEDBF18158 ADCCF529DAE1A8DE 81E8BC73EFE51FA8 6D21BECFE8D937F9 B38873AC8E26A26D 7FA6162774C640BF A77CA3EC8C568BE5 AE768B52C485CF01 61A71E2B56593ACC 13F86FF3630DDACB 68EF37C159EC718D F108959C507E2D14 FCDB24AAA76C364D B5292F7AC0A29B82 A98CE27B1ABCD51F FF0E6C4671C9A6C9 4B4A5EFFBA3BC500 583BA9B1FCD8FF55 D8B33C1BB0C58538 654698D680F37B19 75C917672523071F F82FF7D56BCBC12C 400342596E01B9CF BB913AF2EBEB4A81 D525B73CBB56E794 B731D86B3CE6EB0F D70AB2517FDECDFE 8947FD50A6D78B88 A0722A2FE1C51A6F 23BB50BBFA9969FC EFACDBE5CC2690A5 663CC27F4B03565D 583204F2A5707171 BC8065079723B153 27F87A32F4B7DE2F 635AFA1CF846869A B79824A88B1E3256 8CE3B9D37B3F5715 21942D08B2D181FC 33BF84391EAC01C7 85104EDCD2E40CFA B658E9A9F6767CBA 2ED3636332E6BB99 80E81FD4201A71E6 3AC74F8A3B4708C0 467C8D1CD2A7270F 6F22FD0EB5AB0C76 3A6A3C95BD7EA674 5F10BBC67E0FF7C3 75B82581C6016A6A B455ABF838000329 A19C429E34589337 8C0C413CEC5F5596 4069598E200B25DD AA4B3890C5416462 881CB5FC4B5E44B6 4DEA0DDF53909CF7 5A2A50B4E5FACDD8 A2248984F9431996 0E4AE4CE41379E24 2CA6D4ADE9F39286 9070FE9E3603C0EC 75A29E20E507EEB1 9E5D432815D21F1B 85DFD484F66502FD 2F3611800A8E4D33 6BEF08DFAB34C892 16D66831C089BC01 8F96E31ACB9A1CF2 0BA314DA67F1CECA D20F7DC3F547FDF5 EC14EDB71F1F02BE A1C8A45BC2899372 58B4A886AAAB74DF 2544B226478208ED AAF9ABBA7CABEB09 338D9BBC597DD1EA 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e8846f61-e890-6bf5-86be-d0e15f1299d2
  2 085e77d8-ffcb-8dca-9bad-8f5b10961abd
  3 98c028b1-53ce-38f8-9090-2f9180c02709
  4 943fa0f4-fe1b-5161-bd97-2681d2c3b98f
  5 608d617f-8147-2f53-a620-9986d5c21388
  6 fa7283ae-9f7c-615e-8f7e-573cadf8e255
  7 929b9435-8901-573f-abce-e984f168be0f
  8 d7076920-697e-00ed-856f-aead950d8a39
  9 808fe3a0-08e9-1e84-966d-7a119aa1888a
 10 d5fc7369-a9a9-3023-a152-5aef184224c6
 11 ba3591cd-3052-8a54-8b66-37928475d6bc
 12 97a207e5-a6c3-3977-afed-0323bec283d9
 13 38464538-b4d1-2813-a4da-14b943b9455d
 14 ec8e339f-f816-8635-ab5d-5a0f5f0caacd
 15 9aa7719d-0c88-2087-bce1-7934ac72213b
 16 8df31805-5280-21eb-a34f-c3a0d4879c61
 17 bdbfbeff-f240-460b-892d-5c293c18e1ad
 18 f52dd67f-76c8-1828-9b4b-6dfff18d7422
 19 14081dd4-3158-237d-aa59-930a3710b695
 20 1ec77056-8b75-0118-a1d3-ee1ae2b67393
 21 5205ecdb-f7e3-37e3-84ca-06d0f648dd8e
 22 83023ed2-ad4d-7042-855a-5bf56f0280eb
 23 8221078d-782a-3945-8dcb-6f80208e7f22
 24 8f25aff3-701b-66fe-9496-a6e0521903bb
 25 aa9378d7-7df5-2ff5-9bee-e0d5ad250b88

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6835265013832822412037362. Exactly this sequence comes out of new Random(689).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 6 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs