A858DE45F56D9BC9 archive

201207191303 wstel

explained decrypted filler

seed 563

Metadata

Post ID
wstel
Title
201207191303 → 2012-07-19 13:03 on A858's clock
Posted (UTC)
2012-07-19 04:00:50
Timezone
UTC+9 · title 13:03 against posted 04:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,680 hex characters · 840 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
26
Filler GUID seed
new Random(563).Next(9) ✓ verified
Run
Run 16 (seed 39,036,328) (seed)
Draw
14 · predicted N = 26 ✓
Machine boot
2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

D542F4FCF202839B 68780E130324B0E7 18E1E26ECD0E8C5D AA56198C29F01658 4A7B37F95BC8E65A 8A6D1684454A8EEA 6628484204093FAC C3A7AF8194444A73 01679E685081C2CC F41150865DAB8AC2 B9E0E6F68DB67823 27430F7905DF45C3 6740DF148832843F E50B4D843D2A4576 29F8EA8269AC72F6 8F83485378F0772C 39DFA1C4E330A9F2 36B35CBB741EA911 F1BD20A895AFCF1B 6F94157A4E56BA45 509220F851D927FD 74C8845B0C288B6A B11FEAC1555F3490 084132C4D6075D25 776DA43CA2EC95F8 3D25994E9503BFC2 4B69DE0C28A94925 DD5E8C3E65536FFC 3B85BC6C2B7F9FC9 3B469574525BE2F0 C31913F323D95EF7 7794A60BF81D3FCB 1D96A7BBE36A64FB 9680A048E351FCDC 881B469F22C59E95 E6ACCC20B533B810 E9A83C8343B18EC4 8A375639C5E2FC3A 6E118E85AAA4C2AF 3BE5A8F4E7EC78E0 C65C466B3E71134A EA996AF7115BE915 DC87DFA542DFFABE 08F505F40E5113CA D251FCD3981E14CA 04D6BE34CEB660AD 52DD8A1EC345A5C6 F1D35E893A196D76 5D2D26A8C0B9B3A2 7CA290BF9E0508AD 12FBBDE552251907 77EB09867837A82E A89C6B0E595235F8 0E63FBC2D323FF6A EB8C381047A697F0 10FBBE129B285FA0 10599F7FE05EF138 13A0C57AD0636ADE B20BC884A379116C F62930A8A3946847 EA453F3F578EE904 11F48FAC1C763DD3 A2EF3D1479953365 D26F0CD0E68BF800 35A1BDA5E26AD022 2123DFBA800775FD 0121ADF8D749841C 212135B6C18D3B7A 9C1C94DD9ADD817A 79E2766FEC35FF15 3D4EE53FD47C2984 3FCE7152587194D6 7B58EDE43F62A804 E1B37547B973F547 99D4413E78D67B9F 6292843A24DDFF68 873C0F090950A272 73E3F22FC40B3676 14FFE944C442E7ED 8C5385B94BE7701E 6B3B2A480909854C 6B81377F1DF50771 B9BFAE0D0F6599D9 8885208312A0E538 06A825ED0C3493BD 5AC87E9168EAD7E2 2CCC639FAD80D5F9 80F749EEED397B58 656CA6F6B2E9BFBE 2F6B9FDD5323D869 E6FD7E0AD8D5BE84 461AC18B4C527368 6E29AC9D7D559745 D9DBE7DD5E2E1CBE 0715DB5BCA723D28 553FA7959C5D278B 4868CEEFCE86E889 A50409160459445B 2444EEA3D8449D9B 74495D59DF763EB1 0775ADC48D97F132 91C7D91A87A9109C 25ED6B0A46A13B64 D49084F595CF21F7 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,680 hex characters = 840 bytes = 105 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 26 GUIDs as hex (shown below).

Decrypted: GUID list

  1 050935dd-c4fc-705e-8fc0-db46d1ced884
  2 8efd5b62-9809-034f-b178-1b5de74ff6b5
  3 26ee73e2-f1f9-2284-b916-3c6c1cf331be
  4 71f7c9ba-8c25-687d-b36b-fbd3b71ff551
  5 f20ede7c-e4d8-3136-9985-7a9bf95ad37a
  6 e3abca72-bb02-5bab-b58d-1a188a592437
  7 0434df11-98a0-1229-8893-4e724e50cc57
  8 be3fdb7a-5848-829f-b957-cc5fda61f1f6
  9 5b00f165-418c-55d8-8f51-dbcc6e803ad7
 10 6deb9e6b-09c8-7d55-be02-cd811da37701
 11 fc60631c-31b7-0167-a30d-ae3df88dae72
 12 a2f6ca45-ddeb-0a28-aa2f-75be1d92cf3b
 13 79c25226-53fc-6e48-8a50-a4e75f4c413a
 14 c2e0220d-d06b-3edf-8cce-48d4e02648bc
 15 8d15b258-0176-058d-9024-91416bc53756
 16 4b9d59ed-cde4-5e5b-a9c8-6e3eae62d6b2
 17 1cbe63a6-901c-4911-a4cf-0af9d16ceb6d
 18 065f5640-9afe-0aa1-be27-6aaf6ce31e24
 19 33ef6049-33f0-8f41-8aa1-4891511bb9a8
 20 27b47b92-a5f9-2042-9fb6-e7cc0e37bf02
 21 10831ec4-1dfd-53ac-a151-0e58389dd355
 22 503bf247-7a1d-84f9-95d4-796c4ba5be4b
 23 fdb013af-d3eb-1831-9ca6-66e5e54fa540
 24 ccca28fe-4def-6990-bdc6-c274f26a9374
 25 0fccce98-1351-7be7-9039-862931a56280
 26 65439a16-f15d-5e72-ba05-d173bdd8eaa3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70263518570063054082581675. Exactly this sequence comes out of new Random(563).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 14 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 26; the post has N = 26 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs