A858DE45F56D9BC9 archive

201208032000 xnbay

explained decrypted filler

seed 310

Metadata

Post ID
xnbay
Title
201208032000 → 2012-08-03 20:00 on A858's clock
Posted (UTC)
2012-08-03 23:57:51
Timezone
UTC−4 · title 20:00 against posted 23:57 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
36
Filler GUID seed
new Random(310).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
17 · predicted N = 36 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

E2FDD2179468D318 BDD80EF437A9FD11 7D7F4F4B7CF7B0CC 7759D73329B26D72 FF06E050F89D6CE2 10377E4B56BFEE40 EBAAF0147E9757D5 CF21FB999BBAE036 10E5EEA2A58D3442 02A39652FDF3A8C7 9B291F3E4274A12B 48F9F0C6DC19890F 565E95B8FF3952F5 1210CE9001AD9563 A537A3C27E9210F5 21BD4B2AAC87FF97 DC72629D0258F8C5 206C23CE5BC3E6BE 4C04AFEC3C07435D 43287AD47DC29EA1 C48C190A03DB5973 1DA3C819BBD7D8FD 76CE29EAEEB1AC08 5ECA774938E77F4B 0807F337DB43299D 70C3B6AD092B2C26 335E8E0424E59C9C EFA17CA4C5BF0086 E9D1CB3D6A3F146B EFE8EF43731A9F66 7C330F46200F5550 8C8A28DEFF6F9245 4A3ECB9F74F0C302 5FFEDF3542E6D228 C70C53A66CC03DEC 6D697D2B4E84BE9C 7CF0EFE911C59020 7B8007A99AAAC513 2E0BA501DD7523B1 FAB8C161358DABE8 6A371B6D39AFEEC0 8CB843E5B471EC0A DBC90781B4D7854F 754FC416CE767282 7BE0BAB45352B0A3 A301506F7AC124D3 D43B0C4534CC7D3D 77C090EA2AA2619F B26338BAB8B24C44 ED796E16349CBAE5 7295F91BB444B2A2 8359FE406F6BA38E 0DD20024C8D4176C 78180F413A114273 D18C56617769C3F7 53A7E22B74BD7D01 917B5F91B92D4519 9AA5081CB71A57A6 1CEE8F0873A9009F 838F9ACEB6006D10 F54C368C13D627DE 5BD0F42A1FEF2093 3C40E89A33E94B5D 494A5D9BF38A3A7E 621ADDDFFDE54FBF 692B4111A67AE7F2 6AEB9EE646E375AB 93E2B02EB5BCFFE9 AA17EA54B96243FF 2BF52FB83E04A8B3 A43AA8C92C950571 877D22418FEC87A4 D53B55F53E7B410C 3597F4DA96E9B508 18161D2954B72195 754348820E27A959 D20FAFD2C504CAA8 FFE21B5E5FACED2C 0210947806B7315E CEC9DEFDCBD26817 4B153E33C0ADF5EB 3D9FF39A1800A72B B1C5751B4D9B7A2B 6F4E9C2113B49891 17118FFFFE7F593B A4344ADCFFA35EE9 2B8448C7164BF3D5 146F362AA4563515 C2A767B3FAD43BE3 9940FA9F02C5E888 48118D170072558C 098EB25C02F9AEFA 2BA56868D86C01BC F60A68552A45C096 071C3528DCF9F2EC 199CFC92A92674D5 9C69240BC183AACD D6AA48ACC69BAEA1 FB8130B2603F486E 525E753CBA474A45 FB9E8B15F9993A27 64F47D3EEBBBD8A7 58E6E6D9AEAD56C4 D245A62A22E0CCBC B6DDF1A02DE55EF7 16D869C003F6C3C7 DFF05A57FDDF9741 C9E6CE3E08413AE4 933D37D1AB9A5374 6B15E52CB6D3220C E0345147B4D9213F F60187870DBEE0F4 3842A994C3CEB0AE 6292E9D42BB8F6DC FBA73408B029CAB9 CC990023FE8C5B56 F5DE64BD090C2576 B092C36C9FFF6F82 4F85CCCCC77C9231 F7BEA788ACCE06D2 A2174EEDF052A85E 8CC6082D6363BFC5 02F630F09981E327 FA1D3B1ECA187A56 2449E65C22BCDC94 D6B583032DED5404 957433C2F084C592 B7300FB98F8F7F45 E5E62634DB1AA5C0 8BABDF90D2CDF2BD F8B8110CD2CD63B7 4D74DD40315B6CFA 44806E929624C9BA 8212A2EBA1837DC0 83C5610CE4FA8DC2 8E2D9CE61A21CABB 400FD0A11B9AB224 45F194A2B9EA4D97 E7D818275DBDCA0C 35512253BC1D04F9 A06A0726A8F1F11A 4BCA4107993F4AF1 A85DD5C2904442EC F12BCEEB5A845CC1 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 137c7779-8b66-64ab-b0ec-952c17888a61
  2 151916f7-811f-6e07-9c03-3683eab184bd
  3 cc56ee00-198d-4169-bd21-d4bd29fac51a
  4 e8a00db3-4f76-6a82-9a87-00d0c0f8b336
  5 3239099d-a449-1eec-a2e4-dc72e71f7077
  6 a1abe8b3-cdaf-4f64-a483-cd341d0753b5
  7 607ab2e7-935d-7ddf-a8da-b21d07e97265
  8 188709e9-3ef3-8b28-b84a-94f9f78733cd
  9 1037eac1-73b7-2917-b11b-ac4cfbddd2a8
 10 6d81a8cb-97f7-5890-bd99-53044d826e95
 11 fc4a0567-bfd0-6395-836b-472c4b3aa44d
 12 0180eb78-3a20-4785-a8e3-bfa8564fb0a4
 13 b8127a85-d3a8-60d7-a301-4c13d50bcf26
 14 1db6e707-6c40-6dc6-9265-cd3661849221
 15 1e72cdc0-d06c-8b95-bf56-1ef9a66a0d6e
 16 c90596e9-b93e-5df8-aeb6-38584bda2d22
 17 906b473c-786d-1581-857a-18b643060561
 18 6b559c70-45a3-13cc-90f2-2a0533b54ba9
 19 5f7da4a8-53ac-0907-bc5e-a11477b8aa76
 20 735ce0f3-3a8b-390e-a6ad-59ab5794545b
 21 53f984f1-5a3c-0aa8-b67c-6b9bdc064564
 22 eb19c156-2bc3-8914-9e7d-cc547c31f961
 23 29e9b4cf-d02d-31ea-9b02-c38c7f46e65b
 24 eafa2aad-c27d-2fd7-b153-3942cc991b7a
 25 d242a80a-0d54-0b61-b878-afd2652d1c85
 26 7b40b53d-4f5a-8461-a06e-edf0e7acb228
 27 1d012baf-2fc0-48a7-98a1-6f240af72146
 28 85c2c304-977a-60b9-a52a-e90fe71de436
 29 15c7dc34-2fef-137d-8b4b-fb4a1c82875f
 30 debcb80e-c11a-6893-937a-9bf60918b389
 31 52a6a685-3d11-5a27-af5f-65b6a475420a
 32 1855b374-155e-0c3b-8bdd-ee9916837615
 33 7e58982c-7183-8b4c-90ba-74cf2897985a
 34 4f1cb6db-0e99-6e75-b467-ca8e54c7a48a
 35 105494a8-6b7a-71dd-9dfa-c09b6a13628d
 36 699262ab-8553-137e-a181-015dc05d0c86

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 664614782564668511030832084616508671. Exactly this sequence comes out of new Random(310).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 17 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs