A858DE45F56D9BC9 archive

201207201259 wuucr

explained decrypted filler

3DES(name+name) ECB, 30 GUIDs, seed 248

Metadata

Post ID
wuucr
Title
201207201259 → 2012-07-20 12:59 on A858's clock
Posted (UTC)
2012-07-20 03:57:49
Timezone
UTC+9 · title 12:59 against posted 03:57 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,936 hex characters · 968 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
30
Filler GUID seed
new Random(248).Next(9) ✓ verified
Run
Run 16 (seed 39,036,328) (seed)
Draw
16 · predicted N = 30 ✓
Machine boot
2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

F8D4884F3FFE2C79 CF1BB92779FDEA6D 1D9A657DECD9F787 702ADE3D94E66419 8BBB6195409BCECF 87A5F8B860EFCC01 3CA5E123A313E6F6 6CA0A152205746C3 CE696F53914BF0A9 5C0195905F683C44 C367ACDDF8350219 E55B94F0AED896A0 D73ABE174713FE89 A3721E99C673CD2A 3E5D901A9DB60201 CBB646180DB5E77C 734E400298B0168E 143578FA5930009A D85EFFDD8A3458AD EA5E6C3A5722FDDC 34A0AF838FB6F256 59B1C0020BA9D9EB B978D3DC13BC3263 530E8C4EB131DCBE 7B3A43B43C514A60 CA64F7EF1B3AD1EE FDECD203CAFDF5CD 5400E64D8F3A7DA3 3EE6D14FBC8B32DF 1016F59DAD2AEA64 F6F60BDFF9390CB7 A02C7A3709927984 6BD5AF5EDEDCFAB3 F987A03E94C9FD03 C4E7C97ED941F33D E91C360D192A13C0 F37AB477CE4DA3C7 2681EDA2768ED701 EEBF4660731B24B2 5CF6C3E090EBEAEC 692A23B148925276 8527784815E86E60 D7817D67D6927B1C 4C8B55EB56314E65 3A14205555C39B63 79C36CBAC27F1A23 78F4FBAB5BFBD5C4 17C0C48F5CE5BDCA 437345BC25F1A2EF 01CAF8D09346874A 73E267D7D57E38A5 B0F10F65E9538DB8 7F713F6DBF323E23 F213E9DC7B2F01C9 A58B7A8AA808206A E2951D0A88D021AB 2FE87DF711704054 D67F487B6E936AD9 FC5F0A457DA0B568 81AE6ABAF59965B2 26F6B26868F2A8EF 9F287A7341528552 74B5E125FE24134A 84D1C5DA2F2485B6 64BB666EA77B28EE E09E036631630A5B B366B7E0AAF45FCB C19E9CDDDA88D805 E5D29D384B75057A DA1D481329E2C0A0 9980B84A3C9DFA35 9F500A5B2DB88557 E5CA966ED77FE0BB F76C4DD7A404F487 896E98794C9C7452 A5AFCAC2D0E5015C AB7F472562C1D1EC BAE9C4F478DF9701 0B6E218A30CD9467 F87F966F35FBEFAE C1987CB27B245DB2 F0964A5FB558FB65 2E354B0E6910DB91 0625EA0D18C8A476 06491428FB198288 92D6CFA8348FED2D 85B29F2888FC3BB2 9FB9C142D6BC2EF3 EE278E3728EDC033 E49B50424B0B3341 EDF8E2A76479765B A7FD22498F1F6896 C2B5A38FE0CC274F 14E9C786B07E1D2B 95D5ECFD15CD19CD 1956F5A21074F0F2 A83ED58E5AF24C74 CEDEF1EBCB21F908 D20331DFAFE80038 6072CFAEEF7170F3 814B339ED59B1842 A2C09521D9766BFF 6FC7B4686F62419C 35777C62030AFBEF 04B7396625A58F16 E24F17879240E598 A731FD8BB785D577 78E8F2AEC22A51B6 4CF8D1860CE87798 938DFE8FB064DD9B B00C0B2E2C2973F0 83A734564FDF6B3B 50BEA5D560FCA874 A144A88C1F102C8E 60D7D34BBBBC9017 1B01D04B3C822D79 AF1289A98D1E8CB8 A8ECCA15BB0AAB05 5F2CE875EB184AA2 14163A5C8736BD2A 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,936 hex characters = 968 bytes = 121 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 30 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a2905566-5690-25f2-a8c2-bc976e704d1b
  2 35655268-d50f-5d5d-a927-94aa41e731ac
  3 6550e35a-fa94-1d74-9a12-31b918e7bc16
  4 b85f3abc-0cf3-4dd9-92f3-4e797e209fd3
  5 1478dfd6-700f-1725-94bd-44909ab5feeb
  6 55dfc5c3-f5b6-2465-bc15-c7661a03bf26
  7 ae0c4536-f22d-0700-837f-0ddfabe03f46
  8 d63d04a2-77ce-730e-a7c5-6e24de2c3530
  9 e4dd5f54-f117-5c87-b47b-23485b1846be
 10 d6bd5eda-fbd6-6aa7-b361-9fcbf80a5edb
 11 170449fd-8da1-06d4-a2f2-29479856dea4
 12 d890e574-ee79-0785-9991-65741efa2467
 13 1b50f959-101f-1ccb-9f87-959a62cf056c
 14 759c0229-91a1-499d-a2bd-5eaac798129b
 15 07ea9fb0-b01e-5255-a6a7-867b89602034
 16 1d863373-2080-89ed-847e-9c1399e4103c
 17 d5b2b9f4-549a-19ac-8060-fa44990ab26b
 18 57b0e0de-4d28-68ec-81dd-cd2813c0a131
 19 9149ea0e-f9f1-35da-a10d-43960988b73c
 20 9d49371f-2c75-3556-b2a1-c7179d8c21f3
 21 84f8b042-70d2-603a-963b-086c02848ded
 22 5619387f-c6b0-6766-b629-0f54f88d5445
 23 a2c78cb6-7bfd-8198-96d3-078be242dfcd
 24 08e94528-dafd-6831-8380-c97ba7cc5825
 25 bf9bfba7-4fd6-07b5-8c64-c218ea2a637f
 26 3fc46432-17db-0ed2-a912-8236294c293b
 27 d82dbeb3-3ca5-16bc-a2db-ec5978bdc50f
 28 1bf4502c-41d7-3017-bf78-92328e064c3b
 29 a1530934-f274-0b1a-9995-93ac667e562a
 30 8f13a4fe-cf65-7ce2-845c-3837afe1b42f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 251412075600145816336686001307. Exactly this sequence comes out of new Random(248).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 16 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 30; the post has N = 30 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results