A858DE45F56D9BC9 archive

201208031522 xlx8t

explained decrypted filler

3DES(name+name) ECB, 26 GUIDs, seed 897

Metadata

Post ID
xlx8t
Title
201208031522 → 2012-08-03 15:22 on A858's clock
Posted (UTC)
2012-08-03 06:19:37
Timezone
UTC+9 · title 15:22 against posted 06:19 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,680 hex characters · 840 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
26
Filler GUID seed
new Random(897).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
4 · predicted N = 26 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

2C7445B71834EFC7 068FEAFF967CC84B E3AC0CA655BD245A C6054913B6A81532 6BFC08B08058DCA1 E2C24EAC844720AD E01C65DC0F456DD4 6ED6BCEFFF13F705 DADF1CBF6912480E 4B96538E76C88967 58A0A158CAA8580D 4DF62F39402043EE 1A934AB404E8029F 37DC995FE86CA086 879BEA1FA023D484 4EF00EA1F9739917 E10CBFD0C827B50D A21C9192F577F373 3D02F2EF98DC2791 946AD93E1FBFE32A E47C1596AF3EE81D B07E7FBF167A3BF3 D18949E4BACB01E0 F523D843F27E1A50 759599F1179EF651 AFE44D932E40E518 0EBE133854529378 851DE7A35CA01A00 3797D46B76F89E3D 185EF603D8FB92A2 1550B683240ADF57 D5E5E3508C407F00 9DDF37957E14EED6 1AC81A3AF68E041D 64AB85BE11B6438B 399C39EB31FAAABA D4421BFC8A2D7D92 AA0E01B03A275E2D 13671E4B6535D770 670F0137CC9A614A 71F602BCFAD2DF69 C7BBC0A547FF3F3C 8732116455DE58AF 1862EA7C337479AF 20296D9BEAE486DB 0C05C58B22ABA2A3 CF4C3174721C16C4 75DCD9568A979420 82B41E8A0940AE80 8874A6DBFA852CB1 BDA88CC38617BA09 ECC0487926925345 926CFEAC264C82FF E9204AC3D9A36E91 3B5D0A39064C2772 BCF2510D7D66DF07 00925472C6F9C5B3 8CF21272DFE35D79 DBED3421D731C63F 759D7FFF59B2EFCE B4AE9283BE1000B2 49945D9494CA3D85 CE8FBAACA4F0362D D65A08A993C5E709 EB78D93BCF3553F6 F083F31BC90060BC A1E8EF5E85E9728C C44A85713161809B 8CC4E88D94A5EAB1 0C4924CB22955281 EF324B32C9DAD55F CCB44301C10F1D7B D58D390365CE27AC B38BAE368D7A5966 D25AF6F71A5219B5 B3B6506D46C1F19D 453E59A9A70E3654 8FC0FF534BDD3C4B B00BB8878A538CA9 0CA63A2D9C602279 E0BC9E60A498BA96 059F2BA3AE4B9285 BC9329174937852B 00DEB066B55DE518 0D3A8F5B29EEA8C4 1AF3A6403A3DEE46 366F7660FF17401C 24F50AA7B4E4A9E8 A85B432FC11AEE54 2EE26CA01B396BC7 35DBF6784412A675 B2663602C2B28E28 387690D60212335A 1AED61237D29EEF3 14C024FFE49ECEAC 25BDCD0533DEF22A 32132F11ACE094EC 3F35A1E33A06D27E F07C3A5D84C59276 AE572C224EEA7316 559D8F928354986B 0BF151B67C57AE99 4E52C7B517E7DDFA 59E8BB81DAD64EB1 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,680 hex characters = 840 bytes = 105 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 26 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ffc77497-efad-3572-9b58-a50741ff0196
  2 d6087545-03e5-0589-b1dc-7afbd085937f
  3 9a2446c4-1d34-6703-94a2-8a2e5fcf6903
  4 beb8fe71-4991-0928-b065-186f96444f7e
  5 b7cd1828-cf77-110e-a5c1-c2233e3a9bd1
  6 f643521b-9bac-47f0-8f9e-25d9f1c6d5c5
  7 22c7ef13-8343-71e1-a79a-2ac8e2f78324
  8 f9225804-6bd2-4452-a648-e6c89c161b8c
  9 b3eb42c8-11ea-86e8-adc0-1245549d5068
 10 13fa3a8a-3287-0200-8349-c1ac1575482d
 11 0be48e71-f10a-19c4-bd4d-5421198509e6
 12 949d76ef-7d2e-650f-92e2-df80864cf698
 13 11278992-c012-220c-88de-85f6f4b91d0e
 14 55eb0455-5aac-199f-bd30-89a2536d68e2
 15 594a8692-1de8-73f5-aa8c-b3252a5ed214
 16 df603a3f-7426-2eaf-b7c3-55ca31fe2f69
 17 d1ac4c6e-159a-8f0b-aeea-a21cb23e9894
 18 5035cc82-6e65-16da-9edc-8eb6c38aac1c
 19 b87007af-06ac-82d9-9704-8ba0720e270a
 20 58181d35-16d5-57f9-bdb4-110612f13d9a
 21 5ed4fe75-51c8-0705-ae60-ec6a11fd2880
 22 91a95e0d-6cb1-864f-91d7-2753077e5c75
 23 85d46638-d59f-5970-a78b-0cbf82c5f561
 24 cd8ce97a-bbea-3201-9241-01434aedff9f
 25 cf06231c-f566-5397-871d-e1a24dd9762b
 26 91712c07-fda0-44c7-b9e5-1051e9f8f84d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 30601474801621728185085354. Exactly this sequence comes out of new Random(897).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 4 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 26; the post has N = 26 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results