A858DE45F56D9BC9 archive

201207211224 wwpq0

explained decrypted filler

seed 536

Metadata

Post ID
wwpq0
Title
201207211224 → 2012-07-21 12:24 on A858's clock
Posted (UTC)
2012-07-21 03:21:53
Timezone
UTC+9 · title 12:24 against posted 03:21 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,808 hex characters · 904 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
28
Filler GUID seed
new Random(536).Next(9) ✓ verified
Run
Run 16 (seed 39,036,328) (seed)
Draw
23 · predicted N = 28 ✓
Machine boot
2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

C313A5DD88DB8796 3ACBA3CC7FB9732D F3B6C48396DFAF50 2F2624F7D945A70F 9E5226230143D919 716766E6FDDE00C3 602410914C4370DC F055B29D825848D9 D4DDC0487C5DA168 10D0DDDC79F3E465 50F10C95F0A3C387 5E6F75659C22B182 F38B1837C4193A14 1FD1138D888A3FF1 C5C0B19EAEE2FA0A 9574253F68A4AA8B A1B7BF571225FA86 BE80BA4C3D65F497 80742CC7347BFA8D 2210926E570FE663 7B26578C8759182B EECDF27FFE4D9ECD 796AB778F947F609 6F3E4BA7A7C2A11E D1D42F103B3201CE F86F88818DCB206A D807AF9D691F3924 5DF66BACAC9E41F0 6D940D86EAB319E2 7519C5BB2843CA2E 66343FB66378E753 52B3CA60296AFD46 F78B55B58FE30B2A CCB3EB3F6F61D8E3 83E3E4F1DC90D883 5AB4E7CD14A74BB6 FAFE056EEC211B3A 864695B988F0F6E6 7FD81C07FB70991F C25DC33DBE6785E1 4A4C1E2E6FAC5D9C 58DFA45C1CBD377B 271BA0685C7491B9 95B74E0EB2CD72B1 2F633110F1F0E8D7 DAD819AAC069BD85 D97C605A70B0568D 9BAA6060C4B8608A 294C5A7F80E0D201 74ABC8656D2D1154 B90543A1D491C5CA 0ED27E7F44D5362F 1F2C2594AB8D8B9F BB71595CB69FF539 DC1E4A42C9288A15 44F25337364E48EA 45B380EC04F227AA 308452431B8ED2FD 47E257E551A89D9A 14AF2E3AA122C2D2 AE8B6D7A055D3BB1 1119D61B6E5E8459 A64029D59332F1E7 AA2F4257D049FD13 30BD31B827C2385F CD6C8DE6BEABF959 134EDF128773130E AF2E441BE89C6A85 FA97E2B9DE1E4AC5 4A3817ED95802D0E E617880F6D784FE3 67B6CAD4889AB154 BD0765D59AC92C48 5D1BBB6EB2B80484 F0E7D5E844380634 D7CDB728E4C203BB 678214F663A2728A 58BBAEF3ED720838 16535E8E4EAF9A5E 3851B8255ACCC9DE 0A11FCB20B3BA50A 3D18DD82F8C0667F 0CD4BE7BC9DF77A2 F690FD1FC72DEF2E 5A88E5A47399884C B403BB6EE7DFF8F8 0504548E759376FD 73B94CE693312A90 EC90854322B2E3EA 5FF37DE31D51130C 8285EAC5B99F888C 3BE8F2F9403064F0 A3A47B4395D327F1 EEBBF935FB69CFC5 06105FAFDCEA06C6 9FCE41ACA4B32625 A173E95B27CA7DA4 9F0E73D9D6FA4F70 293937302C28CFFE 9B43120B28A873E1 FED664DC27779B55 C1F54AC5E70E0035 C18BA317316E30D9 542FEEB17639D1CF 23160FFC43967F61 3430137B45A1272F 4B976AFD3ED3FD1D 4FC89BAC1FF6D1E4 24D4FF37184E0F48 2151E8788CEC2059 27E770054B1A0AF8 9125F770F76F5A6A 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,808 hex characters = 904 bytes = 113 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 28 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1e77958e-d9f4-6b02-b034-474980cc0cec
  2 fa188d6d-7920-0930-a16a-069614b8775a
  3 32324db5-0375-365e-9837-bbbce22b37c8
  4 18783132-55ad-80fe-92af-ccab65bbea60
  5 346871a0-ac97-18a3-8541-0c176cba9fb0
  6 ec7d3d08-9597-8ffa-bb92-961b23c82b0e
  7 29f2116c-608e-088d-9241-aa364b585c51
  8 5f031398-3d16-3d1b-81bf-a0d68c4ee1f2
  9 a100178a-057b-2d43-a625-d5bac0c9e756
 10 4fe0aff9-ed78-8351-a80d-468d7c031111
 11 7dcefa0b-3277-1d33-bacf-3c4744c10e5c
 12 fc542ff7-97da-893d-9671-db445a3f13be
 13 0754ec15-c631-0fe5-a728-656bd9795152
 14 1b115588-2a56-2019-b137-54c1ed3178bf
 15 b13cb4c7-cb0d-137b-a5a9-c6befb04470f
 16 b80f7fd2-4f5f-6bd0-a561-1037c0101fa2
 17 1fdccdc9-c433-162d-8f5d-9e7205cc0417
 18 75badc98-1e88-21af-83f0-5b5c2c222c04
 19 f8ac3658-9824-13f2-b4a3-6298385f9094
 20 c37e0c11-db7c-7dd0-b94c-c98549add67f
 21 4aae94a8-a592-03fe-b517-053ad252b6e3
 22 e7ef5bb0-22fc-3fa9-8e28-ca306c4d055b
 23 0675fce6-8588-55ce-9e55-c45e71807b7f
 24 76012fe8-4542-2016-8772-27c42b5e6cf5
 25 8cbe594a-e479-24c2-86b4-4eb3fc5dd659
 26 6083414f-b469-2d71-bccb-b5bbabf62071
 27 b831d385-276a-64fd-800a-5a4986f88fb8
 28 d074cae9-5391-7957-b096-c730541c94ff

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6038180328180216121703522267. Exactly this sequence comes out of new Random(536).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 23 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 28; the post has N = 28 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs