A858DE45F56D9BC9 archive

201207211234 wwq8n

explained decrypted filler

3DES(name+name) ECB, 35 GUIDs, seed 671

Metadata

Post ID
wwq8n
Title
201207211234 → 2012-07-21 12:34 on A858's clock
Posted (UTC)
2012-07-21 03:31:54
Timezone
UTC+9 · title 12:34 against posted 03:31 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,256 hex characters · 1,128 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
35
Filler GUID seed
new Random(671).Next(9) ✓ verified
Run
Run 16 (seed 39,036,328) (seed)
Draw
25 · predicted N = 35 ✓
Machine boot
2012-07-11 17:05–17:10 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

0C5B1D8A5AA64C9E 5F2E6A9832668164 13891D49294D81BC 2238317B7686AF76 8358BB791F1348EF 1A3A9B1F5BF25761 27C6B6D01453333C 66ED676655FEE5AC 315404206DF3B8AC EFEB31DB16D1346F 2EF84AC9177FE7EE 405C1BA12E0A9963 57A22D71E8D4D726 A3D60842BAFA03AF D493B96957BC01F5 1D4A7CFD77F9DE5F 1FBDABE59245A051 5ED68FFFE011DBC2 F23C8261F8E4EC7E 8BAAB526DF2CBC0E 00F90561FEA6E5D5 2CEE1B2A586B8574 367684BF0E487F8F AE729C339184AE86 AFED9A4A8D8C3803 DE5D311618B7BA4F 8CEAFE9665AB8171 BDCC86C996FC4637 A3909AE6613247CA 55191271A5D8407E BF7B334BFE60E750 B95B4A7EF67BB78B 0AC539AF1CDB068F 5A16CB9316C4DCCD 0A6ABFC27F217164 7EAC213303554715 58B7C933A09812EC 977C028A88AEE441 D4EA0A6D57EFAD97 1172B3882C75992D 53D2488C5583B3C1 D5612C090F8B9422 45030963F69BAF53 B140A8D86570279F C8E8043400E071BD A844BBC4B69C0E76 6B4179B2462597FF 4E3A8F50348A662F 9C5218EDBC8A871B 1E4F658387A013BB D97B4330FC79326E 4CFA6058C37B885C 32C6BBF2DD0FC5D0 D370F9C21D6F150E F5D8AD8ACF0A0B04 781FEA30FADFCA94 6E6DE7C18081AF6E 2B56BE3645EE8CE7 67FEF5C29F767518 B49B6E53C5DF4FBA 8871D3C90BCD9F8F 3988A8AF2F01951A 15D3B190980264E2 A404AFC6FE890787 CD784ED9020460BE 60A76C445E639106 333B1DD180A7FD33 F2666B53359193D7 962FE8D0BAB04627 D22D763A7E27BF5A 402FD2D232993AF4 6092C4D0025BE541 6982B785E184EDDD 672292534E6BD577 E53B465E66D05C04 D9F7D63B8EF4A7FE 94B9D3FB9E973F7C B78A6BB4E10783F0 0940CCCCEF60C248 5CB009B01F2A3986 B4AAB5B34C83A793 05AF26CE6E2797A6 2F99BE8A9E21A9EA FB7942B5A094B593 C51B3B2847E5C316 F99A717B916BC477 798964614CE1D6D1 477D3A05EFDB0AC3 B8739C3456D951CA C7F85B2736637D09 E56A905AAC43D73F 62A26D8691CEB4C7 7E8DE03BDBB8F95B BFD6AB1EF9704931 E4AA127FC249B179 7723ED9797CA5BE7 841C00C75B296B34 3EA99F67E5EAD00E F7E869279C47A403 B1265BDFBDD89B88 565496B513E3F8DA B804A49E66F2DBD6 AB449CC40038DFF4 56A95CC2EE983157 994BE3A14DDE88C6 4B263127E9D113BA 284FF0B6BDC34DF3 2BDC6BDA30E942B3 0FB1BE83CD757BAB A21D7295384318A8 7737798A10B54167 DE505BE9ACD7309D 4B6B7EC2687FE03F C2E0222294347F16 627B7FD645441E2D 0854A3E910A54118 00F77C58B88B6616 0E697D171AFAFBF2 1E0D8BBB6047709A AAB8D2093C0151A8 D4B618840B4A65B4 85748B62DAEB4381 ACE9B2AE3CB13490 149218BA3668F96A 0CE7A259C7E808DE 6E6EE01266086258 BC5F35F62A58D721 FAE0C7744E299027 B38E4519C6DB3E51 77D0FDB5120BC331 BF2BD5E17AB80F7A 855C2B06211E7038 5A4027813EFDE7CC 71F655DD56ADA65B 6E3FB33AC4DB94AB 7E3A8E7B32F9210C B56B7E066AE8C68D 941BC44FCE7AFD07 D234A65B794337D5 D84FC6A7220B1F91 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,256 hex characters = 1,128 bytes = 141 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 35 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0b87557e-badf-289d-9213-86f9ac597323
  2 5c977b27-f897-6cbf-a27d-7fa06a940e46
  3 6aede670-a5c6-7fb0-b317-aa76b4c3c122
  4 f2879d60-2cae-71b2-b949-cfeb209af293
  5 ff85fc1f-f880-1e01-aea7-af12d8222111
  6 49a431be-11a1-88c2-a409-4654b9bc0f3c
  7 f0ed9010-1093-40ef-9ec7-f801e48a11bb
  8 e2c491ba-0f19-0c52-8fad-818e01bcccd5
  9 042d3445-4139-86db-93c5-6f0e8356d32a
 10 10aee7b3-3884-6231-8685-cc2d93cd90ba
 11 3a8ff6cd-1375-519e-befd-86449890dad8
 12 5fe141aa-0aa5-200f-aa38-ec6ab9bf6889
 13 8ceddca4-dffd-86fa-aec6-64a1fa5a00e8
 14 bf31feef-e2f7-5745-9b96-f9a51c22b0c1
 15 3607b2b5-f588-5989-9a85-a2a1e9ea3f26
 16 ebdf1762-0d54-06da-a92a-b57c88e94b8f
 17 06ac210f-ff18-8b30-b2e7-8afc0c87b1fa
 18 ea1c9761-d6a4-069e-998a-9b9c3fa5923f
 19 1de5e6fe-d0df-7f49-af9d-f9b6b3c50fc5
 20 37062d40-5f47-1450-b4c9-f4272be27e60
 21 cf70a30f-18fd-86e7-bf30-11f96f3eb833
 22 27bc70b7-5999-42dc-bdea-6954c9efd9b3
 23 fe40cb28-db5d-30c4-8983-08cdc8c49a5e
 24 15aa1c53-d234-3a10-9795-8d19f0e211a4
 25 d5c22e76-f676-4ee8-9490-3e0bb3294b5a
 26 8477a6a3-2d53-0be4-9217-25eaa584f123
 27 48a00d3e-fc24-7af6-8008-d33e1ea868d3
 28 e1f887b2-1203-4054-8d1f-4257b677da62
 29 c5ecdf02-8c1f-7b68-8a1e-9e5c4dd5daa7
 30 35ea82b3-3560-4b69-b871-6897d1d04a0c
 31 d734a638-af31-8ece-956c-43a9d5cc38cb
 32 0a24d927-b7b9-16fb-ac36-691699c7fbb6
 33 6820c889-ce07-12a5-9385-3ea106f8a71d
 34 16c90dd8-7cd5-7ef1-8767-9151bb6b3f00
 35 bf9f8fcc-76b9-8d47-8d4d-baa897da5c88

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 26771840865285508071843340747481178. Exactly this sequence comes out of new Random(671).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 25 of Run 16 (seed 39,036,328): new Random(39036328), Next(8,64) per post. The RNG predicts N = 35; the post has N = 35 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results