A858DE45F56D9BC9 archive

201207310006 xfjsn

explained decrypted filler

3DES(name+name) ECB, 26 GUIDs, seed 620

Metadata

Post ID
xfjsn
Title
201207310006 → 2012-07-31 00:06 on A858's clock
Posted (UTC)
2012-07-31 04:03:40
Timezone
UTC−4 · title 00:06 against posted 04:03 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,680 hex characters · 840 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
26
Filler GUID seed
new Random(620).Next(9) ✓ verified
Run
Run 20 (seed 267,961,078) (seed)
Draw
3 · predicted N = 26 ✓
Machine boot
ambiguous: 2012-07-27 ~21:13 or F 06-14 12:54 (probable run, 6 posts) (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

DC790B4EAB573770 98E2B80ACB820BDA F3F5EC2E510B947D C9B8EAF5A5C5642B C9AD1B49C1DD22FA 9DB83D2EAFE23803 D59DFC219DD4F13D 9537F494C03E609D 22775D28F986C086 BE10A1CD02D327F1 4AB5BAF676055865 AE23C6A36850A747 430EE842A0FC1750 F779A70CE91BD27A 431A7702F37C2346 93028C99F80AE39B 33A7A362F114DC18 6B16FDD2F131E320 3370EC056FFA617F 70C9AF3A2C456FBA 0279D8DB88A23B12 28941A1C7AB93665 4A88CF8D91D5550D 4C3E1026ABDA85C2 98C2FCECE160B395 46CA880823AE1130 8B2E973C1DA3AE59 7035E88697048CD2 7BCA976364B2C34E 91B8E461FF6CA0B2 46FE7753EBDA8CB6 ED236FC2823BD47A BC37DE8B576F78F0 EDC4586A7A42248E 48F3AB45E60E1DFA 3E92FFA92366467F A3A316B5FF042111 6CB8E24E7ED9461F 5FC0A25A78B6E462 BA65490E8ED30221 FFB9B60FE506E93A EA00A132AA077268 1BDD726D5BBC275F 30F5261F5A5CCF1F A4607D47F41683CE 9C92C8F6E3025931 3A7A755F2C6ACA17 7604BD0CE95DA009 B57441F0B75626F1 6A12E563BD4FA04B BC22F2940B65C809 44F0D822D82A10E6 724F500B5DF3EE8E ECB12C69374818F5 6A57AD76E10674DE 717FD02F2841CF8A 1E7D7E1058767896 5784CAA9DB59AB4F 4716E6ED55DFE1AB 89F4295435B16415 B4499ACF37628E62 BD2A8BF56E86F041 BD691999818B8963 60AB0239B1B574D5 B461D0FBF5002FC6 5A41078A00E72EF5 D57D775B2A55CE5A C5941DE65BED10BF 698F654F4660F27D 3D99EDAEB21DB721 E8A7FD7598C0C9AF 573F447B7B40D93B 493419D4B4933D3B B731AA949C327021 B7E335DA840CC7D5 AED0BA93273939F1 2858B79F4E297BB7 A465B6843E0262D7 7AE2E67C531F2BFE 1408F65E1A0CAF57 F040EA1E1230F696 B7B87E9671AB8DE0 228F64C039B849A2 4B8BAE54AA4672FE 3F0555A68D64DAB9 1EE72B358FD72478 5D135F325F336506 B082934BFC9A86EE 59E130E18EC83FDE 8A96AB9712DDE5D5 D172C04336A3C8E9 1C75340171530362 5F25E5CB68BAEC0A BAF0B2B9A8B8EF3B ADF34C1F150DA474 6B916C3E7CD18F6A 29EFF3D2DAF204C3 5D03DCBECFBAB29D 3438000F550B90EC AF7D731C73FE577C 882F6E795396B9BA 1BB65849D096CFC7 758FB227CF9B28BA 26BC365C1F0F8F77 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,680 hex characters = 840 bytes = 105 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 26 GUIDs as hex (shown below).

Decrypted: GUID list

  1 278f5f9a-22af-50d3-bcfa-1fa8de030df3
  2 1422b52d-f8e6-6a72-94c6-cdbf1bd5ba24
  3 d5ee4487-757e-1269-a654-c10fb48f2a1f
  4 74dcba1b-a5a7-8301-8a5a-3d564cc75041
  5 f2182c08-a9d3-152d-beb9-4b69d73155ae
  6 d1385a43-d958-3488-b7aa-91ca023a7ec2
  7 205e18cc-8ade-6264-a1eb-d32743c274d0
  8 23fe2ab9-662d-46d2-bc68-56e9661127ca
  9 80757256-c44d-6990-a791-73d8478f0fff
 10 1ab3fac3-5271-821c-a0e8-5ee98a5fc1ba
 11 e1b3303d-a7ff-0ee1-88f8-4599b0bd4d79
 12 e9eddcbd-c040-4886-aeea-a346d30d9db6
 13 97a55059-702d-731f-b929-f66dd0ff6b2d
 14 56bb7352-0b25-0f0d-b2be-2587702ae1e4
 15 e08dd625-f120-8c8c-9fa2-d060504a58be
 16 98770c20-bab6-2fce-82fe-e8216fa342cb
 17 9f7ec12c-7d5a-46f9-b26c-08e52c8bcf8e
 18 24cf1ec8-1e58-3b14-a480-f932b1e983c0
 19 7cb65478-9ca8-4ef1-af39-0e80e4a391c1
 20 7cfe9f72-22cf-3c10-8460-0373554b3bfb
 21 b3f8ce60-3c3e-14b1-8e80-8ab7cfee1a67
 22 9e840b5d-5ec9-8ca4-a267-3217b639640c
 23 d2c4fe68-0ca2-6d66-a0c5-49172514aed7
 24 d8eb6a40-7073-52d3-9e18-71b51a46ea9d
 25 fb7743d7-8665-4d06-b5a5-c3b2263d7609
 26 4e53a06f-aba0-22bd-814b-dca1f90a4a13

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 56181364680470824343186542. Exactly this sequence comes out of new Random(620).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 3 of Run 20 (seed 267,961,078): new Random(267961078), Next(8,64) per post. The RNG predicts N = 26; the post has N = 26 ✓. The seed is the machine's uptime in ms when the app started (boot ambiguous: 2012-07-27 ~21:13 or F 06-14 12:54 (probable run, 6 posts)).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results