A858DE45F56D9BC9 archive

201207202242 wwnoj

explained decrypted filler

3DES(name+name) ECB, 27 GUIDs, seed 940

Metadata

Post ID
wwnoj
Title
201207202242 → 2012-07-20 22:42 on A858's clock
Posted (UTC)
2012-07-21 02:39:48
Timezone
UTC−4 · title 22:42 against posted 02:39 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,744 hex characters · 872 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
27
Filler GUID seed
new Random(940).Next(9) ✓ verified
Run
Run 17 (seed 38,757,453) (seed)
Draw
19 · predicted N = 27 ✓
Machine boot
before 2012-07-11 16:41 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

F6574123612CA5E7 BB45460763D9E930 7622DD98EA35D8A7 056EE10FCECB801C 99C1F1D0D648060A 9C8969053721CC7C 6664456002192958 0468FA430937DCD6 4D41A28E5F99F5FC 0F7A65AA6AE26C2B 7F709A37255A459B 028432809DA4F84E C04E9A47E2FEBA6C 78084863F2A3ED98 65996D8DDE44D513 5A711841F823CC9D FBDA9F4A816AC8A2 86462B44A1B0DD67 4EC19AF96EF89C57 442E69DFD44EA865 D1F99B33219C20D4 B04EC4218637012D 885515454D67BF0F 7E752B973A9386EF D02D41E4340483C3 143B0793822E1BAF 12B28DAA1816211C 3F340D755816DA5B FBBC6913FB11AE30 DF2C863EC054CF00 020D8EF35682A76E 48205048BE6B9BFA 4E3D3E518D20ED3D 26C7A9B5A74D327A 644EB0EE2BA1363F 730D4F0BFA904194 EE25EB30487A5D2A 82F2A8F25B4F880F 614F3B2216F55897 0363FC5707FB7978 7F84C58A85EAB451 EB258500D6DEAD2A 72E71C15FA3EDD72 1559951102B0AF06 5B523347BC12FC44 2A3A60805676F9C3 5399DCF1085077FF 920C33F38413E382 2D65D48F5B76EC83 072037A6FC09B2BB 24B74657C0D058E1 8B4D150D9EBD1BA9 2611154CA6B78EDA 795E7D23708BD2CA 6AC4F817BC3DE7F1 0C0D1FE5C37E04BC 80AA12C8DFBED97E 0D7ECDFEF1707AC9 B082CFD5F83B9E32 6B2C2F122E422DE0 16E39E671A79DBB1 855B00CBB32EF5AB 5DD482EE9FA9890C 256CB58D3B34FD93 A337A74616A67CCE ABEE04304F732FDE BED0E2F8344B2306 77FB5767CBCC9260 1802733826E6845E 74DF41E1692020D9 9479EE6149373258 4238B4464BE92611 FAEF1D6048A67629 7FDF9A20FB966CFD 5E3B31FC42D1E5AC 5C155ED551D99C29 40F3A1A8FC345D3E EFE2E858A4924472 11AF03156E9ED0DE 486F2F3B95489E63 71A791F872AD3D63 6695C28633E3F9DC 3B7D62FB358DB577 7720B1CAB94DC938 E3C061F8711C9423 C994197088F79074 768B1B9AD05BC73B 5143EB281B9CBCE3 B96CB759BD19FDFC 92E1C58A1E1321DA 6DBCD6FB7806F90A 98A4CC7D27275839 002D400B703F7A55 8EE0FDF4BE911F4F E3B9C47040BF9C9C EBC08D9C27D1A100 678A413D8C6C864E 0EEBFD6E2AC1B2C9 BB8C308351D8477E 1F1D58A68219B316 2659341C30329B3E CFF3270E085B80F2 87BF7DEE40E2B773 1FCB32673C5A481F 5F77A432D1640DDE 60FC408471AEEABC D84DD6438DD37DDA 7C81F994E94ED63E 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,744 hex characters = 872 bytes = 109 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 27 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3c489d95-e8c7-76c0-905f-83f12c294161
  2 ed72c919-745e-5bbf-8b00-3d0a67134020
  3 0d74cfed-ee77-7f8b-a8d2-39494e91caf7
  4 89ece9c4-e430-1447-8260-f0b0e9c1a518
  5 98005e55-5542-5ddd-a61f-a4e00d1bb6f9
  6 60b4b6bb-51b5-099a-8d7c-b43d70f1033c
  7 6ea5bde7-97ba-0e3d-9034-65d447a0699f
  8 4b69c6e5-e595-0b20-ac2b-cfaef76b1374
  9 d0bef5cc-4611-2aa0-a5ee-11ca3ef7b7c6
 10 b228432f-2751-88c2-be45-ae149a247abf
 11 d517ff77-b4bf-7dd1-b44f-41df1eff10a3
 12 a4f28a56-9b81-3770-9296-b5c4d6bc2b1e
 13 aec4181a-e1e9-7eb0-b48a-390a5d08e121
 14 3f18622b-3456-4a79-b840-4c5795c38da3
 15 ea094ea2-56ac-84ac-8a7c-f01e7193dae0
 16 e81df211-fd3e-0cf0-a9fe-493267b708b3
 17 bc6151a5-1629-8ebe-add7-f8d284e8f282
 18 abd1861e-3108-7391-9a9e-aff29e6c731f
 19 3938e60a-170a-173c-95e7-048b0cc4ab43
 20 fdafd92e-6321-232b-982a-c68915c69140
 21 d6899235-0e1f-6c51-868b-e8336f90092e
 22 c035a454-3ef8-4220-954b-570c5151e2a8
 23 a267c411-486e-7654-88a7-5a71c2f17b6b
 24 55a4aa33-83fc-3a07-ac4f-4390c322ce9f
 25 58240893-d54a-7f8d-85bf-4dd552b70763
 26 6746f8d9-0b9d-110f-a498-b35752c0052b
 27 39b32d1b-29cd-1275-a828-ea5a30bdcf74

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 757150002873748087126473711. Exactly this sequence comes out of new Random(940).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 19 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 27; the post has N = 27 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results