A858DE45F56D9BC9 archive

201207191130 wtjw0

explained decrypted filler

3DES(name+name) ECB, 25 GUIDs, seed 955

Metadata

Post ID
wtjw0
Title
201207191130 → 2012-07-19 11:30 on A858's clock
Posted (UTC)
2012-07-19 15:28:08
Timezone
UTC−4 · title 11:30 against posted 15:28 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
25
Filler GUID seed
new Random(955).Next(9) ✓ verified
Run
Run 17 (seed 38,757,453) (seed)
Draw
15 · predicted N = 25 ✓
Machine boot
before 2012-07-11 16:41 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

F97866DDD7BCAC29 D6114E150D61C61D B16E846DFE387CD1 981807784FA25E0E CC646DED837DD543 00531C31FFA1A675 7F223E08C26F7B67 E8A8F495E149B645 653A6E082109420D 4CA5A609800BEE27 CF7A7C40202E9CF9 41AF3A067BBC19F5 162DD0703ED07ACB D3566140E4DE1794 86EFF7F178FF60BD B1B938002D97C8FE 76F6AFCCC5FD2E24 C612C839F83BB102 005C30C8DBFE9FC1 F9359DBD7282ABDC 2C90E1ED68E92C6D 131A59FEC20B25E6 E911BE940CDE8A3A 953AD61A06242BC5 DF309036017DC165 ACDA19C8D7194893 987C62AA13456BFE CA0177321D41E934 EEBB7AF5F9F7B415 3A87F80E60F1B583 06AB9C1B109B6100 91566E49BFB86AFD 32B37302764EACD3 B27A0F4B0449D251 0602BDF1A9E0044F 035B26C09E357ABB 2DACCA665B6FE8C5 3030D9F241B0FD72 0C4614850BE23C52 5E25158857D361C6 4F2B8BFD4D519608 8AB14DDFA5371269 69D29924F75997B5 FF3845DC84D2039A C4B07C50BF503F0F 1EA7C81F280E6DAE 1F2287A0A5560C00 4494E695D3F8829F 957122BE5367415E 8DEBFFEB43919C71 A8D6575AF3F0D1C3 A955C4724D33C45C 8C069AE1E090D286 212C3D04F7430D8C 26BA1C38E6C74653 50CA6868F6625561 EE8DBCE7DA9AE0AB 2CAF40B3C341F640 22B923C24AC54FF1 35007DA3A996D3C2 28B8C016E963F194 6F63307221EE8BAD 9527C2D402028CEE A4BD8F7E18AE35BC 01D58EB8FCDC923C BC85E2B86C1EDE3E D91D85660CC7E2D8 5F7115E0E3941122 2B3D5746BE3B7210 D143D2493DC227B0 DE812113CD0490E1 0C03C6EB3CBA666F EB8CF069CF2F3C9E 4A8102955F0EF291 DC689EC4AF4B2F85 CACDA250EDF64E79 2366AD93103B6743 07A4AFB114031BD0 C549BF71AF9F20B9 93D301D4CD8541F3 441314C93EC54176 A572EC0FA88DB880 5BB28B46F2DCE38A E856C797FE35F2B6 9EBC8687425537E4 A6FF6D66048D2819 F876D2C8D261C9F5 4829BD85A1E6EAC2 352F3EC45740E445 99BF56F56B626C51 5FD42F0806C21B1F DAD0632BDF6AC48E D6D5F4E8932D084C 41ACF633A4B9F163 A2F143A4A50E7555 C98C2F92920ECB85 3A68D0A4630B06C3 5BF3D110EFAFA751 9D1AEDA1ADD486D6 F3B9512700FDB973 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 915a5a55-4370-54bf-a73f-7b9d7abce844
  2 84481e26-8434-0466-801d-031fb0d2a3c9
  3 1732a460-b25e-2eb1-8183-f4ea715d9515
  4 2aa9a100-11c2-388a-a0f7-543f91c06c19
  5 ff42c272-0f5e-3161-ab2b-7ed189e46bd8
  6 258e8b8e-92f2-15c2-afd6-5081fbb9e3d3
  7 313c1d42-70e7-7147-8809-596fafd85f16
  8 952c50e9-b360-40dc-8b4e-582cb7646b01
  9 c8aa195a-57a7-17ce-b224-7dbc0aa53e1f
 10 9a970ab9-b25b-364f-a984-298560e93a0d
 11 dd685510-cec8-7ab5-9a7f-ad7a6f66de42
 12 eaf7812b-c66d-0425-92e5-ff4572dda17f
 13 7cc75460-0dd8-1fd4-8dd9-e1d32d6ea627
 14 fdd64456-59f7-2d69-b992-2ffdc83e00a4
 15 1367a814-00f1-44eb-b5b2-1c36494ab3fa
 16 7aca243b-530e-4a89-af8c-10ffb6d44b00
 17 1aa8e3e1-9ebd-2ef6-a570-afc62350b788
 18 07112f60-26fe-0cbc-8a9d-796a03ef584e
 19 c5abbf6e-4cff-41f9-835a-5ded696d52ec
 20 fb138988-7700-0a5a-9305-9d7309bcf428
 21 dcc03721-2b89-6192-836c-065e54312029
 22 41a4f759-c5f4-116f-b80e-a9e68392514d
 23 29e9b5b6-f877-38be-b27c-f173b671f326
 24 de6dbc9c-1dd3-5f81-b545-044ef1b61092
 25 a15bdcf5-45ba-2b54-8c24-3f3bfa567281

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5023317413701244204061352. Exactly this sequence comes out of new Random(955).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 15 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results