A858DE45F56D9BC9 archive

201207202342 wwqnl

explained decrypted filler

seed 768

Metadata

Post ID
wwqnl
Title
201207202342 → 2012-07-20 23:42 on A858's clock
Posted (UTC)
2012-07-21 03:39:56
Timezone
UTC−4 · title 23:42 against posted 03:39 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,512 hex characters · 1,256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
39
Filler GUID seed
new Random(768).Next(9) ✓ verified
Run
Run 17 (seed 38,757,453) (seed)
Draw
29 · predicted N = 39 ✓
Machine boot
before 2012-07-11 16:41 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

B086308E5AB4A3E1 D8DEB36142B35390 F33407DBA445206F 17FB6901660BFDE3 D9252B5E5740DC79 88CFCFB7ADBB272F 158633A74C64702F 7A3214639FEC89C7 122FD8E68D91CBB1 67C0AAB075D587DF DBCEE2D3D4F2D2F3 A817D66F4E553F81 95374F024CB886CA 5FC4F3CE1180E5C9 984A2E4A91479096 DE3DEE962AA7B7E0 0CEA6F827D0CC429 0EE2857A8DF4B149 4C4EF77AE47DF02A 7635AA2FE01F6404 871F02E252A9AB35 41543B36141FB411 F12EBA4D5B20661B A2F33C6EA9344A75 BE2AB158E8BFD97F 063E6FFE76E47FDD EF2CC9B7BC4FE03B D691A00854B3B592 1598D970039CF39E A134CFAF56A97534 49824C41F5513BB2 B90EBC3912B9FCBF 55FEB5C45D866217 34491B8142BB2955 9E9AC85117FDF822 6934256F7D87EB81 84B5E55D0E9C11C8 8BC3B0765F028328 229254E43E2425F0 18201EC5ECE5629D CC4166AC89050B51 4D7E46FEAF091C07 DE6E4A68A44C2CFF CAF636375B1097D9 F32A62048C6B6FA8 39097C5C1DC89936 433084BEF74B89A7 3B10AD0CC93D7CBD AC5C7F8B96100F40 E954F3605673FB17 1CA864584A48F88E DCB60CAF9189901A 89511D31912EF6B8 C6B4344F95743B76 BA152DE4F593E070 D4804FE2F1964719 F51454D4636D4F28 B2B28634BED9E279 8E50409C3235A902 E31B2C1B73FA83D6 A0B4C19679DD2402 2EC1A5A7080F9487 6A41BA9EEB3E09C5 2E2B23D9FBB72DCD 59F1573F33728843 A9F14373793E39CB 6B273FF3D0134EE4 36DF209DA2BF2A84 34FE01B02741B146 026435D5B4C385E6 AF9DFB3AC09E9EF3 F65529FB9E8DD7D3 212D627C6AF95015 D07713A4F58934DC EC04BDFA3DC6B98C E65A162F2563DF41 4AC9AFC349B2834E 00967030C81D575D 4555FE87DBA19A08 C6F422769D55BF51 8803693442F9135B 69910CEDF4B3C11E FCDCF0C560C5B916 CF1E9C3D09A6CB2E 65B5A9DBCC54F97E B561BD5C0C26ECBF DC1C1F7E68D81B79 CB12ABF7A8CC2CAE 49D4091DA8F29424 34A1BA893C32BC55 85D5D6D8FA33F5AA 26275BDFAA5A7AFD A4800155D6E19AFA 2F369C989E0E9AF9 0C918909B037A078 4CE69BA4797F77D7 26B98D0181A503DF 624780E061EFA4BF 34B139B69AAFBB19 891128F0504A6870 5DB60EEACCE539A3 8A7A627420BEDE29 906A2F988889C695 2D1D3B4C44717447 89940354971FA09E 165FFE6C0D4A1000 EB1238453AADB6AB 65D939DBE227AF8B 619AE2776EC24FE6 C4321E07FC2F7825 F5ED0BC875DF410D 1143750F0CA34877 E6477C8FEB8CF134 8F09433C231EDAA3 622A01BF33018661 12D2CF2FFBA21B86 B3DC064957B5C028 3FC138F5D86FD22A 79948510020D446B E32D69246C59D40A 0BDCBC7D603D5C55 5EA3F8BACA4ED92F BC7E9785F212D422 2AC5265D1B502B13 992AD8ED004CE747 2FB2D3E26FE77B30 D50F709948A790DF 8C18E632BB91C238 5A45E96D6E675874 7E588585477D9CAB 4689A1646E1F7441 3D160A08D456373F 834F190C77A059A9 74974F55308BFE3B E337B2843F66A6B3 583A2CE4EF4F189E B979B23DAFF02F5C D3D552B8EE4E7154 BC8F0E4BFC3F9365 184474884BEFCB2B F130936993016CC8 CD5EFDDA9469AF32 2F6365D8BAC43461 4B83274F699826F8 98C32F1658F0330E F27B6DC9ABC2E743 ECA8B126534BE00A 7A60CED7522676E0 1E367D925C269A19 FE0F14B02690CB82 9710DA9B6DE33EC0 0DFA3B0DFED2F4C0 4AC9727E93C9D22B A4D363BEDA80CF4A B7495180744415EF 021759BA874BB195 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).

Decrypted: GUID list

  1 627c0bf8-28c1-8a45-90bc-feee6f9b5083
  2 dcd7a11a-a158-12ce-8f8b-020973fecc4f
  3 70bae899-ab57-5e94-9e47-ae8442cfc403
  4 d07e815a-2c57-459e-84e0-ee5e6d7540dc
  5 d1894616-d20b-8626-8d1b-6db7c20ab4ad
  6 d562e4c9-88b5-6843-9784-92b367db4a14
  7 02cb86e9-95ba-0d51-a7ee-cdc4f70398e4
  8 b4ff5e4f-0096-6e5f-bf06-cd24170a3604
  9 6fbca62f-bd2e-83a2-9b8d-df80578d2b28
 10 86ca4fe6-dde5-4086-88f7-e1e43fef2645
 11 e0072525-823e-04aa-a75a-576cfc3edfd4
 12 c79a11ad-9f6b-082b-bfb8-4f35fef66ac3
 13 f4e86bba-53e5-5bc3-b97a-a7b62ce85a3e
 14 58e45b3f-e7c6-0cc0-a82a-9b8e952f6fcc
 15 2f60739e-d267-5f02-aa6c-58c6ad693caf
 16 bb15774b-21c4-576e-aba9-8ffbf472eca9
 17 42676c0c-badb-674d-afb5-17182f2ebe79
 18 ffdaa1f1-62c0-1bc5-8cee-90f9a666a47d
 19 d89c3dd2-1a90-4c33-a7ed-92becb3af278
 20 6802c22e-d1a2-66fd-a933-d3e16dc96e9b
 21 9b9e36bb-6a33-79ff-a764-239baff25340
 22 6d92ddbb-b49e-287a-a380-c4399a88b9f9
 23 fd13a387-db45-79c0-bda6-70b1d7b26798
 24 a2d1542a-3576-270c-9001-4d7b1508c712
 25 78a99674-1cf1-8182-a3c2-9398d309a50d
 26 02fcacc3-a00b-4f36-b704-b04751b1398d
 27 5f7c524c-c4f4-20c1-be4f-d57f11e71677
 28 31351455-0b92-40d7-8ed5-60777de52a52
 29 5724b46b-0f3e-6fa0-b603-782994e4a900
 30 2eb2b89a-932e-5de6-bbe6-af1afe1e844e
 31 657edfda-87cc-68a2-8f85-9aa7f9d61e96
 32 9dfc5211-c8ff-6b6c-b6ea-a4f0e964d5f5
 33 074e9b84-8a53-1fd3-8296-1b562fe21fb2
 34 d4f33113-512e-20b1-baf8-2b46de906905
 35 a8a67a4d-e9b1-72d4-9fb9-26c06800342c
 36 7da67e0e-c783-0380-b6d3-565be7f77695
 37 42fab57e-d11a-1000-aab1-7713d2dcd8e5
 38 1e89c88d-5e8c-6f91-838f-c1583ffa8561
 39 2f9ec19a-a795-732a-9257-541fd1dd6bef

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 815486068400505561467272842465661270167. Exactly this sequence comes out of new Random(768).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 29 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs