A858DE45F56D9BC9 archive

201207210024 wwsmd

explained decrypted filler

seed 127

Metadata

Post ID
wwsmd
Title
201207210024 → 2012-07-21 00:24 on A858's clock
Posted (UTC)
2012-07-21 04:22:03
Timezone
UTC−4 · title 00:24 against posted 04:22 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,680 hex characters · 840 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
26
Filler GUID seed
new Random(127).Next(9) ✓ verified
Run
Run 17 (seed 38,757,453) (seed)
Draw
36 · predicted N = 26 ✓
Machine boot
before 2012-07-11 16:41 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

68EDC8A231FDEFD9 6A15B5D8DC00A9C0 D5416682C4B65596 0D4269B5C29FD5E6 70D35091C8131927 A7A30D7C3E7EA122 75873779C4783EDD 75A81FEDB23DCEB6 B43864A9858F3433 BF3EE19181A97F85 AC41DF4D817203FA 45C490F44E893237 244A5275CAD8F0F7 ED13B462DD63AF5B 84D8B1DB74D58591 7FC551E6A042BAD6 0F290A08CCB50185 402E37284AC85369 B1A7BCBCF67B299B 50CA00FA8227BF56 2AEAA11095B409A0 50F34D41C0456A74 6883ED7E55B5A3D9 E070F1DC375F8DF7 46A76002992FBBBD 32EB98ADEDC6D28E 4BAF57293442DF98 59A94B669770DB48 3B9452D35F00B789 F45D03296F4498B5 66117FA2E7413C2C 8B3B431BCCC1A48D DC33EF7110118730 975B5145A1F66158 F6EFBA6BC9D12754 3328ED263E246027 BCF4A11955AEBD95 09A38BB197E26042 F4A53316E299CCE6 B8D66D6F9B2D4876 B62B495719C26295 188079F18D5019C1 9991925D34EBC0C1 44C54BE54E199A22 B657B64745AC6277 80D2861EF63391A2 3BAC482E4B7C7AFC 47C4E05771512DA1 1A9F33D916FA18C0 A004F2E4E96AD88B BCC6167CAA7F8178 E5BA723AB30E944C F5BF2F5C817F73BF ED319636BBE73789 4BACD05C76190E40 C3C58F207299E2B5 567963FBDADE367F D06D9B9F145A222D DBFA5DF05DEF8356 A53B1A6D34E5CAA0 9A7377A9C43F47A1 FC129544A1ABD7CA 7748271233E1B3D9 344F9AB7689C0FAB 806C30065ED4ADC1 775EE95F56865C4C A66907834E5AC207 D838E54F55080B6E EC7D6B6EF3D6BE3D 27E1DC0625FA1460 C6CBB2A0C725BEA6 69EDCBEEDE6862AC 1EFE24D0A49A4670 3D4E897FEFDD1429 C60FC821F7FEDD56 58D5B61E5B98C781 6A059D86A1A72BCC 655A626B778FD9DC 15C321A436B46D2F 9C93E2D8685580C7 A2725199D61AE26D 7F5CACCB7730521C B5A55CC0CF59F6EE C98045EB1C14D46F D0B1C246F093E801 30ED3682F1856B88 660A935351355D18 952D3F47025C409A 3957F12BBFD4FAEE ACB30CA78E016B44 E9EE432760979C1C C5B795453EDC82C3 2D5E3F536D1B485A 5948102AB7CCA892 FA948BBA1006223E 8CC180DB1D53B7C2 5C9464DE85D286F2 55DF1757E4C4C95C 716075912924780B 9545DD6BAC4162CE DFAED1BC20A41F79 FBD7BADC8D6077A4 5D055286D85BA079 79986A77B293EDAF 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,680 hex characters = 840 bytes = 105 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 26 GUIDs as hex (shown below).

Decrypted: GUID list

  1 05852d1b-b5b8-07e3-abfb-10bdfed5fe13
  2 80968ef7-88a4-03e7-b5dc-f25f4b81804e
  3 9bfade98-1185-447e-8515-49d778bd97f4
  4 b2c8c3a6-d3fb-50df-a6eb-7755c2776181
  5 96d70802-ec48-4c3c-ade4-f0920e92e208
  6 ef0dd619-fa3e-406b-bcc3-2bdfde8853c1
  7 fb1cb0af-c854-7f51-b6a6-aa3a7da059a4
  8 9febf679-55cc-198d-bb19-f8e7ea62e433
  9 afbc8c54-2e8a-6515-8060-ca1563126649
 10 62944195-3f97-0483-b99e-a4b7eec1cbdc
 11 f14ec3aa-8ed8-766f-91df-b9427f4689eb
 12 2572848d-a038-5204-871f-563fbebd4098
 13 09111798-2922-886e-93ad-a8e6ddcc80dc
 14 1a268a81-4dcf-4582-9243-005bc07e3961
 15 68c76990-edad-71d7-9d31-b2acd534c87a
 16 9fd3c991-0d22-3915-b560-df2b9035ff9b
 17 61643d66-6ea1-2838-96ea-335d768b0d00
 18 20626422-da36-6c58-a372-f63547f9ba2c
 19 ad27c38b-7de6-15a7-bc18-396970449a61
 20 bee9f063-5e5a-4fe9-a592-f410028e04be
 21 ce1020f4-1d58-6e18-a2b8-c5436a075787
 22 39e1d4b1-2e7f-06c0-b748-737bde1581ae
 23 509f4869-3073-4b41-8476-0897abbe0c95
 24 161d2637-faaf-3871-9e4f-404cac51836f
 25 e247e2dc-b971-1985-8fe3-bbb25e0c5932
 26 131082dc-2dcc-1e5f-bd4d-08917ff01108

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 00454471607584732614604311. Exactly this sequence comes out of new Random(127).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 36 of Run 17 (seed 38,757,453): new Random(38757453), Next(8,64) per post. The RNG predicts N = 26; the post has N = 26 ✓. The seed is the machine's uptime in ms when the app started (boot before 2012-07-11 16:41).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs