A858DE45F56D9BC9 archive

201208032040 xndf7

explained decrypted filler

seed 514

Metadata

Post ID
xndf7
Title
201208032040 → 2012-08-03 20:40 on A858's clock
Posted (UTC)
2012-08-04 00:37:53
Timezone
UTC−4 · title 20:40 against posted 00:37 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
36
Filler GUID seed
new Random(514).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
19 · predicted N = 36 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
17 · 3
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

A15BFA07F86FB803 258C0A536A6E6C2B 80B61907486762DE 924680F500CAEB98 E291DB51570488A3 4BD998A876D1767C 096FB080E3B00030 51AE75014384579A 6F7FEAB133ED285B 16BA251981ADA0DE 37946A236C7C0BAB 2B23170D9F1F6CE7 DC56517288713F8D 88220744B1573E60 DE215A2ED5F44045 26E34C20D39C7878 6DE3332514A2E08A 431DB21E38A54DB9 B9E035438A0386ED FC7A600B13C78111 7B9339F208E870E3 B5AA256CD1BB1036 A3E621E8EDE3A68A 05A3311F12012F63 F89B0B3DA0E88685 AAABC0C9D39AF8ED D365D521DDB6EA70 6900D247A2F3C5DB 46C995426332B498 66C900340A4CB44E 73F1EF67666EC236 6C5DF99EFAEE65F1 761668A611158E14 DB60C059A3844008 A1A5D6FF9C45D0A0 06A8610B4BABDE89 41E21250FD2518E3 5F3310C2D2EDF9B9 78B7FBFDC54650A1 7C3B5E7001B33A83 E97FFB31C3164502 25FC201E903EC490 02CDD1CE6B046002 9B708DD4ED9981F3 31F690BFF158F213 4FEDEF886FF3520E 64DCA95D86ABA32C A0AAEB256C73F868 0E9D7B2E491EA96C 548057AAFC0790A7 621C44901461B971 DE9DCB8F2BB1B7BF 210621E2D13A9286 01A355117974E9FE 0A092EA54F8ED8AB 3143873DE1086847 3517876E3B544E94 3D59A7A11E93F794 0CE966F7DAE7F049 8D075F68FA5388EC C9871FB5B010BD66 11CCD970CCF05FF8 B80073DEE04CB343 3700A8521F4E3FA9 0C4AD0106CC38A2A D075E77C4560590C A909E6D41155296D 4C77F1F51EDDAAB6 974C49BFB9CA72DE 9CE795C8853109ED F27A4C039E95FEAF 49604A2F01FBA634 A274E61A1A9BA507 E9F257C143ECA2B5 42A13A196A99E6E1 71D4F62580111F5F 220BFCCBFFA7AC4D 27CB50FCF715AC30 30838F0986EC9706 C470008B3A6AB252 D593C4E245741403 CCE001627AF4E26D B7F0E1C7203DCFC4 E7FD12D492BF84F2 430021A3FED714D5 3041A63718240BDD E7DB52141397708B CFDD8C4863C1B3A0 AD4496099F5B5978 6E61EA7F1A309473 EED19EEA0312D812 2F43074A1C201951 1436991071645F08 CA8B422B1CDC17DD C794F62BFC41C154 1E3F1B0EDDCF9BFD CFA999F45758C5BF 396795E8158F26FA F980815FF7079F2E 5CFBC0370B3561C7 3198BA703D19D458 08361B84F081C956 376FE417B65E67FE C2FF071A06E860E8 6FE8FB985F2360D2 D3B161377987AC4E C80D00A4A8B7E69B 62ADD7C642D82274 89679FC63E6017D1 6796189876DA9E67 CC3BCA601DFE6629 204B07006E27B1D7 77BE8F20B426AD5F 2672B711615014CA 34F1914672A37FA5 9EF42E1EE8E51144 171CF63D1F38938F 7455FEC37D73EB39 BAACBF84D228A27D E556EEB0F3E95BB0 AA2648CDDCBD016F 43DF43452570AC2E 53D255E2A510A355 9407622E34B3370A 871D47B7F747F26E 5CC13B97B1379D0A 2FC834302900AE9D F0CED6E78DCA3076 84D12181094D40ED 7A2A51D912D5869A EF14DE05B3F99DBB 4B8F67333CA3E9EC 9E6AB37D56EB2F79 F711D7659227ADCD 1350E20C3E8B391E 8D395853F54710C9 F9CE4D1F1F9B464B 91E018AFB0A78895 71F08EAB47B8249E 563AF68C08C60249 549EB2A063608594 29B077F39E486DDC 64E1C4071BE92C10 EE80FF25FD9D055E 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 9baad95c-7269-2fb1-af1e-42cdff606c05
  2 ca62fbc0-597f-58db-94d5-ad1fafc64782
  3 bb9cd4b8-0f49-00d8-b4fa-b6811925c30c
  4 48b7b141-1e9b-20dd-9a6b-f6c6d09cb997
  5 299e99a2-ae62-21ff-bcd0-6845ae8531c1
  6 a9d8145b-492b-61a2-822e-fdc364a34d90
  7 824cbf96-49e7-197f-8d1e-2b909a473af9
  8 f8e0f793-0426-291a-a94c-55b704550463
  9 c1a5e60d-a8aa-5761-8b39-3a1d163937d6
 10 267f1cc9-cafd-78c1-a8a8-40d20993cea3
 11 4b823985-9065-8a09-8304-5f15b727497b
 12 b3ab25fd-4e5d-6ad9-8d5e-3b62388c5583
 13 37db1cdb-ef23-87c0-88f7-c681bcea1a52
 14 a99e1a33-04ed-78a5-8c98-5f0bb4b8ffed
 15 ed31de7d-2402-661d-9ae2-b3104f160461
 16 f85aee79-4164-0452-8181-d078503a86f2
 17 347d8b4c-86f8-8e55-a296-37d822585571
 18 5531cfaa-6513-6426-a31e-e36e6a5cd97f
 19 89990f59-d72b-58e4-8c9b-2d4f2b964300
 20 2b0e6511-6f85-3c32-ba25-37f13928ce14
 21 45daa1ed-e140-1074-8288-4340d09d2cb1
 22 980c7315-9b25-86e6-8755-f32fe09b46d9
 23 8b71d330-5894-73ac-8c5f-374db956821f
 24 0b25d3d9-8af2-52be-997a-e71f10fbcaee
 25 50d345c8-2a73-021c-af56-c2d05a2b2a52
 26 828f6960-415b-1702-a1cd-6120c887ceac
 27 1436b5af-d84c-76e8-ba1d-12882b145eed
 28 9b196594-f75e-1df7-87ea-8d040e915694
 29 3c92dbde-f812-49f4-ba12-367f99448e50
 30 6dddd096-9d01-07b1-bdc3-f75c8c003d9b
 31 0f916f3f-ff9f-8335-856f-914f1b438bab
 32 e7494973-7981-75fe-883d-a763b3e56219
 33 6f3ff898-3b74-8369-b3f2-36b12f41ab93
 34 a8ad1e3f-abb4-78b1-8444-7f9b7a1f4314
 35 6b417dbc-d30e-17fd-9738-82b03105bda4
 36 549982ce-473e-089b-9580-2e5ad9cd714a

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 250226125786876086531875017140878710. Exactly this sequence comes out of new Random(514).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 19 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs