A858DE45F56D9BC9 archive

201207160102 wlhb6

explained decrypted filler

seed 422

Metadata

Post ID
wlhb6
Title
201207160102 → 2012-07-16 01:02 on A858's clock
Posted (UTC)
2012-07-15 16:00:52
Timezone
UTC+9 · title 01:02 against posted 16:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,744 hex characters · 872 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
27
Filler GUID seed
new Random(422).Next(9) ✓ verified
Run
Run 16 (seed 39,036,328) (seed)
Draw
7 · predicted N = 27 ✓
Machine boot
2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

32CA61A480E3CA47 3CF1BB0F01E0F944 89CB000879038483 D998B5059CE4E58E 4CBC2132CE6B4A94 AAE6DA7A9614AF3B B0F0270EBEAC0C87 12EDF930E56F3891 387BB659E28727F6 178EADA582460CB7 57334EAF8A318180 75CBE6187DD08411 825EEE5733F5039D 5E4CCF0957C192A5 23F007185F7E559B 872416067F16353C D34B3F02D848C337 DF0AAD4017327FB8 00D04A5C2ED443CE A1753F78AFBB9008 6DB40265E086336B F1626C1C6F21038B 137B2CD21D4F6CF2 22CB9F9434B0F723 B035033920E82DEF 3A696531434A76A6 3E1B2D5E370A1494 4C206D13A9EEEE3F A15E7C2A841407E8 E438309E159B65E4 0A8FD8275A2D3AFA DFD15E14A66D1D0C AB36FA1616B7D324 66F51991CA47E60D D497B37A2420648A D2291640AD1878CB 2B159BAE714F80DC D4512E042A9D5BF6 A6D3F61A10048F26 B559DB05A16D018C 77AA1958D86657E3 0BB2EE3571BE3119 DEFDE2AAA380ED6A B0A86D73B15DD053 BCD09AC837C36B66 9B968100FE2A614F F658E3807FE3DC0A 52D4E786525FFA9D 6EFBAA82461F8613 630F1AE79899412F C74820AB39F7A530 8EA5A37CFE7E892A 7AAAF1410D452E1A D227A572AC0767B3 1E79D0D1E50D582F A7DD4EBC39E00010 B066193575EF1770 7E90BAC0E5158964 5C4889803DB4DD55 4A7D068E8BF55D9F A34AEF320A84C1E3 3D1BE434E6FAD32B 29DE4466A796A91C 606BEB95635EE0D3 42A59DC651FF0153 9BF1C3679E05A59F DE8CC5E6FAC8301B 3DE8B49114B7F6C9 05D69C308A8220D2 D76E8ADC88AF918D 697D34857587AB31 864EF232C8FE32AF 982164D1A5AD8665 E25BF24387F90EAE C48A099D933F50BD BD8185237D22D121 94BD53A793C75E2A B1C4156CD812E7AB 49A539BF4F9E8415 53187F9ABF3E8DDD 34B6973C1652FA67 EDF7D7CB7893F6C6 16859C53B9A90B8F AD9881FE48EAE5F6 3EA9A1A003093765 8272D17E80183561 33265407B2856E60 7B41B25B67C3BF20 424A3BE8CC88C807 3AD8268A42A12D28 8AE45A84330BFA09 9EE4E8530D14B052 2C0E7D114D87355F AF2653C459489E31 0FDAE7E5F3C9A0E9 610EC66A9E7C4658 D5B730C3F0741C29 96D0CC8561B0FEBB F42029B8C6261CBC 5D33C21FB9A7DA87 D1F4D52D41823755 0307BDE2AD02802C 48669853E8C2DECB BAC373BDF6ECEE64 65239B8A601234FE 5DC0062231A4D2F9 B21204531B7F4B07 31D3AD44650598C6 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,744 hex characters = 872 bytes = 109 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 27 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d437f740-4597-17d3-84b9-6f5dafa88f1d
  2 eb085b81-16e0-5952-8123-682987e91851
  3 f0e43702-dc87-619c-b2da-52a005cb5a67
  4 ab84676f-e46c-53a0-bc8b-36b71c8d008d
  5 1c34f694-407d-6693-8b53-868407c0673d
  6 faf3a800-fca2-375f-a7e9-9668e1f20ca8
  7 da070064-6bad-8a4a-9521-0404e2945753
  8 a007cfc3-ad78-1223-9a06-df36f5619d0f
  9 bb7ec0d4-912f-1847-b2b0-37454be3a072
 10 838b11e4-8744-7329-bd81-25d6e810eb3b
 11 3c332a40-414c-1ab1-ba73-0685c24e8acf
 12 104f397e-62d0-8c80-a955-a7c10a08e41f
 13 f8f842aa-e85e-6f05-9982-99d69fc5e4ca
 14 2d45bacb-88e6-07f6-acf6-2d82e612d2e7
 15 c2c36075-55c0-36c2-a77e-0e66b55eef5a
 16 5fe4e36e-ac0b-5259-b5f3-19a47cfb3981
 17 e95cf374-3ff8-2b68-811e-e3c382e1208d
 18 31563b26-4c66-51ff-8082-6b74d6ec2f66
 19 c5720e92-cb77-0a08-9784-0aa95ceeb0f7
 20 83ea66f7-2497-6016-bb23-f100844c2769
 21 1b9fae81-6e2e-7b06-9c24-64c6d0fdacff
 22 d5032471-1ba3-3391-ae58-d92479a3cc22
 23 cc298938-224e-2d5d-830a-d91f1952ddbe
 24 cd172855-ab00-4fef-948b-23d5a449ba9c
 25 3bcb4187-592e-0c6e-b04a-5abdbbbb6131
 26 aae5f585-72bf-8db5-92f0-5ee1403ad57e
 27 b1a24edc-d227-6c84-828e-c571799d6db2

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 156563811718603525067324086. Exactly this sequence comes out of new Random(422).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 7 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 27; the post has N = 27 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs