A858DE45F56D9BC9 archive

201208031112 xlkak

explained decrypted filler

seed 147

Metadata

Post ID
xlkak
Title
201208031112 → 2012-08-03 11:12 on A858's clock
Posted (UTC)
2012-08-03 02:09:35
Timezone
UTC+9 · title 11:12 against posted 02:09 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,000 hex characters · 1,000 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
31
Filler GUID seed
new Random(147).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
2 · predicted N = 31 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

B54F4F88919A3E5E F15702A1A00BA6DC 4AADC5A9ADA62A90 AC5D3D4179032597 E2690094DF63EB12 2A8D1F165E2F2C40 6222F89DA00FB279 4A36F7D662773421 DC75E378185CE854 93A0DB0F8902B220 491D4417183A9A4C F17CD246CF38F5F1 771234CFDF93842E 48C0B1166EDF031E 999AD15C4803ACCD 4BD0E96C585D6D32 9B166F1BEADCB90A 7E68A22AE3E9637A 25A83EB24ED27E5E 3A2BA3D16C3676FB 0BA577AC63964EB5 2F5C8A7F01171BE3 6AA25A83557FCD1F DC0FB3A6169FD467 0F5B6B7F9E2319B4 0E8B6756A714736F 3ACA0CB2ECEA13C9 03818436B3B2B718 D6411558A381D871 406B1A24233CE933 536D0D73E9C62C63 3CF1F02476A6814D 3E56AF23F6CBE9C6 CB637C483E5C4373 3FA9D82D97498280 C67B8CE9064A45DD 9543E4605DA91B82 D6DD1DB6B3FD2637 0EBBA0D031FD31AA 9536992A7AA25845 A579647166BBF24B 2A36FBB663703528 923A9049E72914ED 2F460E6F70FC0B5B 1AA7FBE5B47A97A1 E00A58C5D430AC3C C893322F22E66CC6 B11CC43E51A13E58 BD3E813835BA5ADC 63019DFB1A238556 059B6CDEAF7E1C85 B3A8344A5ED18C2A CA62CBC51AD793B0 1969FE25A98EB76B 6753100114856094 06EF4C7A28B8D595 E7CBC5DDD9E122FD 505A0E7A676CCD81 BB32D9FA16154159 8013AA1C8C846C9E 9DF7124914CAF434 C8CA0B87F95A8DA1 2ED2B1EC21EC7FDD 7D3ACE7749F7C71C 8D3F53F3775F7CBB 6A0DBE2B02F40E45 F81FA14BA54E8969 05AB902970E331B9 2DE11D6029326F8F 956FDF37AA019548 D0CC7C510E4DF1E6 D8EA7D2C5C058767 358EB247B0B2722F F96862BBB4F7C998 EB4BAF1B5A33248D AE10D45B5F05AA38 82C5268BD62CD915 8C6D6A6F32E85EDF 6A67D505C18834F7 C0914037B88E0B95 69AC1F0ED7D269FB 86E90C30B3532DD9 7670CF5F11F159AC 8CDC1FF73A77123E C4B735AE542BD402 DB2CB4AFE7EA34A7 ED6FA52299EE1EE3 2AAFF5A691CE64EF 3F130F611B949041 7EB76B31EF7395DC 7520B094C6E79645 745063364F55D794 D5BF11B40B3E559C 39A19EA462158864 EBB4480E0FBFD374 6AB17153F22DCF97 ED71A2805612AAA5 7F12A2A67935D1FE D615559097F35E2C 7A4BE2FE1F57F0DF 8128437A371661CA 36ABDF86FE473ECC 0F63A7AD5E03F729 EA5D1143881D2417 5898D2669B731011 5B57B20D4E3A8456 74D063232326D536 76B1BA55FB831AB6 865B7FB35F734499 13B3CFAF2FE7E95C 66A4850E99F6A056 7C347CFB55635A9D 89DD82C457052501 0FB724451C284489 6D6B0CAAFBF39A54 ADCCCB84DA7A63EC 178AEED1E36A1274 BD361CB3CC7424D6 8E1ACCA763F92DE2 E5F11DEF8BA912E0 33755E949A1316C4 9E4EDB5AE9E983FE EACF7F0DC27F9BF3 4045C15A10160BAA 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,000 hex characters = 1,000 bytes = 125 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 31 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5f2494b7-e2f8-4b74-9f8c-8f2a982eb87b
  2 1b6a7e8a-8634-86d0-97f6-e5472f9ed16c
  3 2f7006a4-8848-497c-aa2c-d0b54633bd22
  4 9814acf4-2748-8078-8894-7e99989c8270
  5 803ebe54-d935-5fd2-be65-c1c75e57480c
  6 37420171-f8de-0877-96ce-8f07b04ada10
  7 8299dc39-8ad1-6cdb-9d5b-8b5146f6ef80
  8 845f08b3-e220-18ac-8d07-8707bd423360
  9 4b3e5906-9b6b-16e6-a187-f5ead826b848
 10 2430d32b-6895-48ee-baa9-5863fd75c4c0
 11 98900130-b138-5e33-99ce-e52870f5f1a2
 12 ead37d42-17a3-2cb7-b9ec-fa74f3dce047
 13 65cebb28-3abd-6563-bfd8-396ed676af91
 14 a1115e7f-cfc0-859d-afcb-9d76bd627bdd
 15 168ac365-ef6a-7edb-b62b-f056488e8480
 16 3505edd3-fd30-7ff5-bf13-04fed51a11cc
 17 ddb225d1-1417-576a-a8d4-0501cce0d744
 18 9dde6342-dfbd-12d6-964d-c70f9703b2e3
 19 f9ef12e0-28f1-59d6-a8df-be1192f5d7d9
 20 961e3dbf-4cf7-20cf-b50e-e99d80484ac1
 21 3e221b5a-9f69-31ea-bab7-f37eb5c1f747
 22 5255fea4-4077-88c1-9f7f-8a9f793c23d3
 23 5fb49b99-d4b1-7085-8d5f-6fcbf6ac0e75
 24 cbbf3eb1-c785-357b-9e25-acc93171647d
 25 4c873915-626b-06f1-89ec-523161e90d13
 26 374c75ec-8685-004e-a574-98ae89ca71b1
 27 92527f1c-43cd-2361-a3f9-9a0afa9210e8
 28 fd011cfa-cd92-6bc4-9eeb-32e85fa6a36b
 29 d39cf2d4-4127-1172-8fd4-ac1af5e0d985
 30 df4ba213-83b1-40e5-b7fd-c5b3392ae4a6
 31 60e5d6ce-c768-4033-9927-474a26ef20c3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4848506114526877515238730026144. Exactly this sequence comes out of new Random(147).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 2 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 31; the post has N = 31 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs