A858DE45F56D9BC9 archive

201207202312 wwp5w

explained decrypted filler

seed 174

Metadata

Post ID
wwp5w
Title
201207202312 → 2012-07-20 23:12 on A858's clock
Posted (UTC)
2012-07-21 03:09:52
Timezone
UTC−4 · title 23:12 against posted 03:09 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
37
Filler GUID seed
new Random(174).Next(9) ✓ verified
Run
Run 17 (seed 38,757,453) (seed)
Draw
24 · predicted N = 37 ✓
Machine boot
before 2012-07-11 16:41 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

0C00CB4F4ED4F252 3ABAAA67D5842719 2DAD11EF1EAC2034 B6EC5AEE62E2EC0D EE9692A0114908B9 2CB7E4FE66240667 6DF056CE032F8CCD 92C955F4FC72C136 8C5566349460A57B 882433534AA62760 906896A6E3EFE999 0C321EF7EDA0A680 ADA77B17C9CAAF01 20D53DE93AED31AB FB3053F8C0AD273B 3991AFA0CAAE2699 AE03C6CC5859F963 755A684B32A28862 36932A92B57F3599 DABA14D53D44BB27 EC944E7CD96A7C13 7B1561265426947C CC34F5ED1AF80261 B443A001489B2207 B96EBC6C20C91F41 EFBB70C30E953B03 6740BDBA7F0C8994 1A4934440FD3B168 51129C4BA5878E9D 12D515B47198A052 6E4E3617F2D0FFF0 62C3F81293C551D3 35FB2710A7DE5085 1F32AEED0A3EEE8B 8BE8C78D5DD50AB9 20BE9D6DBB3054BD 780D694175E9D5E9 90BF930729051094 18644309B5536DCC D936B8237C539ED0 ADAE1C1DE6BFC722 B27DB8E01553CAD8 86E65372CA54C952 16DFF17A1C7B5D06 779A8D9EBE3A394F 04C2000A2ED2F18A 43B959AC8C6958F8 BC03F648DC5DBE41 B49EB442EB8ED7B9 0B3EAB7387E6E8F4 36D05AA9455602FD 58ADBE086714659D 23B40FA7A259B952 4D3EA2B30FBFC760 03196A0DA58AA022 8C8C210997E67226 7D8810658F058C81 EB194E38EA97B282 C3026CAE5E6CD63C 2AC1A9B36A4AFD0B CC415DE8C985BC25 B584DCE2BBE34902 0CDBB08A66595981 A4602ABC575D98B3 0CFBD30E3DC34AF0 56E60C064CD8A031 087E735C2F746F07 9FDE90BF9823B0CB EF6D0C81E3EDF118 44B7EEA8281937B6 186AC0F8757C24CE EEF4D58791A257B1 4B8A0B3546345778 29612568F1758E89 30DF0AE9572846FB E70B3930367C8B7D FFC248F215754621 39F4FF447CB207C2 46959DDC39458B4E F45A386C3D59151D F0DFF5E7059EBBB4 130AFC9A2C0138A7 56EE8F98AAC689FE 5B667C5B2A47F431 9EBAE828DAEC303B 461D0EBC5E61CF7A CE98FD5B85849E63 E9DDE0631C43B449 37A4DB3FF5191CF8 37F16F07D2AC853A 6D9DF925FAF400E8 1851494A1D349F8F C4B3C123B29EE5AA 752ED516B60E6343 8F0CC08CEABB378F 6F7D973A5D0E4362 A4B62593F259738A 23E69163AFF0218F E9201152B76F96E4 D40DBD6F4FAC52B6 733D89D2F71DF631 8B856167764DB102 BE69EA19967BD05E D3FBC4D43CB426F0 0A43FE66B691BDAA 8A7C8A87801AB42D B1C3E63DE57E488C 56B4C9D7432C167A DE0428B2AC679D76 EECB96949FCC246A 9688B1B82A4EAEF9 D4240217B8660174 23E09C09ACB7938E 06A1463F56D12E68 526674F5A430C7B1 6159BB374E962CC1 8648020E0A871589 0769A2E67C473038 6403377E52321AB9 BA2C2829EF0C2481 2789A3CB39C1AFF0 5216CEB6F1E9E832 C870B917CDFADB8E 5A0BC412DB8C620D 1A86F48E3261A5F6 BF406CD5584C607F 7DAC6457BD4D8B0B 39B0EA70E685B37C E8324E16EAAED429 2A55916DC2B4499B 050793714D8A2C1C 459F60DB115D713E 6377D36FE71DBE65 BF79B0E8F821E9F3 8F8D92C9869840BB 7A459E9908A4EF47 643783E0FC8228A0 4CD6099558F9E55F A307D2541D285A00 9CFFE5A0223C07C3 ACCAA3677B108A6D B85810056340AE04 52A0D0F483B986BC 22FB08A627093EDA 80E9C3023F571D1F B7792BFDD34DB542 467A5716D656C5AE C9B7B5F02E5316EC 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3001d1a1-13ba-5d8a-a746-7af7816b37d5
  2 47f59920-2974-7a40-a600-b8513c00807b
  3 351ed658-d3ad-3fd0-bb99-1ba3bbdeff52
  4 44c81186-aae6-66e9-835f-b9cc8fab879f
  5 6affd1ba-02fc-6d89-b4f1-5231f7a12bda
  6 b0a732b5-31bf-5d11-824f-4c66aa6297cd
  7 b1471eeb-89a1-7165-bcce-deb641ac00ba
  8 8aec210e-9d36-6b76-8608-ebef157de553
  9 273f2d2f-7229-47b0-90c6-c32e9675d3b9
 10 2dd1c968-7ec9-3327-8b70-36eaa74c11c1
 11 8d96101a-dbfd-4fa7-915a-fa96f29a5955
 12 f2dd8b4c-71cb-2013-8330-333af8d0ef58
 13 8faf7d8c-aac9-2d89-89fe-3d70918be77e
 14 4a258696-c281-884b-b527-79b2f9df3074
 15 1c848e5d-37db-66bb-8d4e-d4a920cc492c
 16 4e18e641-cc4e-6baf-be75-b5af96deb3bc
 17 249bdbdb-58aa-0773-8426-4832075418c5
 18 ced50a1a-b022-729a-bc91-909f8b3b926d
 19 14e6ef11-a0a5-3c9e-a2d6-4bf120b74798
 20 32fc4036-7a65-6269-9b18-25f38cc423ba
 21 32459042-7da6-8618-ba85-e8f39398793a
 22 55742e65-6d98-4c32-ba3a-b3d043ef51a0
 23 c06a48c9-cb49-3d11-bd71-c3613fe165e3
 24 ef72d0cc-a87f-7367-ad27-e9746cc3a745
 25 c1b24323-a26c-6bb6-9f3f-7150c77d957d
 26 d4e82245-4091-3007-a1fe-cecef22cf20a
 27 614fe740-5fc0-40b7-b31f-1ea8bbddc7bc
 28 b38fdcd3-110e-439b-be71-3d8332da976c
 29 9c517f57-98a9-55e6-9dc5-3b9bcec3a02f
 30 29f4b45e-e506-1051-b2f6-4b511c9bb525
 31 53340965-d5d6-3469-be16-f909134df823
 32 b0399334-1e2a-26ba-9201-4dab3d623f60
 33 fe6eb28d-ca9b-2b35-918e-36f8010e3d41
 34 55fca74b-dcd5-3d18-a1f9-e9d093996b70
 35 a210231e-69ea-3d08-aaad-18c365ae8737
 36 05009765-42d0-29f1-9215-a5c9015484ef
 37 645a4cd3-356b-1777-a902-ae2cf07d8a1b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5736657643422866073684376344513223321. Exactly this sequence comes out of new Random(174).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 24 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs