A858DE45F56D9BC9 archive

201208080015 xtuge

explained decrypted filler

3DES(name+name) ECB, 34 GUIDs, seed 34

Metadata

Post ID
xtuge
Title
201208080015 → 2012-08-08 00:15 on A858's clock
Posted (UTC)
2012-08-07 16:12:28
Timezone
UTC+8 · title 00:15 against posted 16:12 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,192 hex characters · 1,096 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
34
Filler GUID seed
new Random(34).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
20 · predicted N = 34 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

1F2A269864B93BFB F033A992917E7DD6 CDA225F34E7CB87B 4E6BCC961DAE9821 C25001A744061CE3 34744911173473DA FA7C518F58FD740F 87BF961785F25B01 3A04E8A105FA4398 7D18F061293692DC B6FC3C24747D59B9 9C478198F4E64202 EB0F1AF8C8763A24 1110C4CDBCA662A0 F9F5EC50353D0F99 A9104092C63850C9 5C1940A5E9ADA6FF DC163B5B6DCB0584 1DCE1E80D4AD7BD8 62E108279DB7A70F 05B965E96C4EBBE8 4E09CC804D90443D 6262F631E682DCCB DF89E877390F54A6 01C9D0508F9A825D D1BF4DA1A34405F8 873E65186E7A65E7 41BD9A0DE01674E5 C0237EA631B35DC0 04C2DA59D1C44D83 31DE302B009CCF65 D8F18B2E87D3A9E0 AABB782BF6016FC0 51C67D92A0C81A09 15AF789D6E4FA8D2 ECA196DFBA3528D4 5426575FBF8366C2 131D8EEEA3E10CBB 20B1E7FB18207D7A 5DEC6D85E2851D6D 8F990B0653003AA8 74799FA1C97248C1 9A05BF790A8198F6 BA3A4987B9AC865B 7E171E0064C07C13 15F57AC5BD280318 87180148DEF231C6 8E6F631115F5C57B E2ECCBAC388B4D7D 07E9C182E55264DE E149A9582CCA98BF 339E8C82628B2640 7CB812D4903395BC 30775BE7DF50FE17 74F39AA3890C5E46 1B16CE827D5FE771 C2CB64BE0C2EE679 D69DC5FEBBAB83FF CFB66EA60DFA496F 4262D7A7C66F7083 B46BD439AF378575 6D524A6998F5B2BC 77300F952E3D31BF FBDC57DE102F7715 08B4601AFA5EE633 67D8AF1046C4BB15 D259C42CB6172D6A 4BBAA560515D83B5 A4B7C5D63B5EC20B 90D61128352607FC 098D1611A2008445 F7A119B41096712B 95CDA3C904D52839 D505CF7EA5E366D1 7D4D742A76526FF6 81B14B28AC618D83 42BD3F6E7D7EDB8B 1E82D0F2803C40EB A1AF1DDED09EF2EA AD2E389A812617B9 B5E2A54E7D7ED3B7 CDDDF824329BD00E BC6CB69D0B41DA56 7015F8F0934BE1F3 785606D81D990038 462D41B3BDD3522C F30CDA8ADF6F75B1 8540ACE5346245C4 FBF39271D07C7151 DFD15AADF72A1B24 C4F65166B72EC365 84C28A83097B8D50 BFCC6B11E8D529C0 0BFDEF9BC025C765 C1A8E8FAE3416D68 795C55BC8E9AEB09 C7A96F0EFB910D69 E56D96FCD28A5769 2BA871EBB1295227 EF0FB3E725C2B595 29B80385AA5333FB B6AA074516EB95ED 2862DDB6410D546C FEB4D4FFA961218A 5A21EC6E1C41AF7C 7C7E938C2DB8F1A1 9F1149CC87CAD2AF 411512803A884377 30D60B5BD5664FA7 2DF9AF96A83D29B7 31D322BBEF58B14D F9C4A4842A0715A8 310365358AACFD12 5D98D381C2080A51 CEEF7E1F402B52C4 207CF85D3623F90F 2929DBCC07284A88 526B7704729C6BB9 F8DA2A86F3D2F283 3B2DBBF985810843 A7909F4EE642C091 FE515B0443E5F1DD 6AC5071B1A01F627 CACED5C7457DCC6D 4331A5D50E28D186 F275D2E1A437D6E9 44E404C2A774428E 48406D3DE41EC4F4 ACEB6089B80157CA 4931725FF951F4BC 791627AA6F6321FE 97E0F7370D9E6379 E2FE1941CF42DBF2 91E07B174537A038 04E7F2775D111105 01DF05772891FD33 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,192 hex characters = 1,096 bytes = 137 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 34 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2c877d5d-46e4-4f2a-9a18-e1e8a0598a2c
  2 b97069bb-d2e3-7d51-a1c6-ef9511c532ae
  3 a65bc257-f911-415b-baed-957b2ebb8a1b
  4 45fda759-4c95-7252-bd9b-f226e67b9f50
  5 8724cb5a-838f-55cd-a46c-3791ee9a409b
  6 8a08e51a-a176-298c-880c-33f7ffc02496
  7 7fe69839-6b93-12f6-ad9c-34c327561ab0
  8 e67785c8-7850-4f49-a5fc-e9a04ffc770d
  9 81754cea-45ef-193d-9de2-93a26c1f5f1e
 10 50e1c740-d411-7bfc-a7ac-57393a022f08
 11 eb8ef8ad-958f-3339-828a-1b94b58f1b30
 12 0134f65d-47ec-0df0-b2d4-92a895e30393
 13 5c4fc547-0c81-0742-a651-0eed7d1fd5eb
 14 71f87951-90f3-1e19-a270-fa2d0d532e18
 15 1b59faa0-edfc-7828-a57c-4ed45956eb25
 16 19c3cf7c-46c7-26b9-934e-11211e069833
 17 d286e007-d004-1593-964f-f1fad5f578c1
 18 f07503b1-cd7d-0555-ac25-b83b51fc2bf2
 19 eb2db8a7-0a3f-53cf-bcfc-2709034298da
 20 75e758d8-c2eb-4261-b36e-6e2d830cc181
 21 088dae5c-7d40-3e59-a093-3822166863a0
 22 ab3d5a80-bf2c-1fcf-bcc4-a6cbb6abd05c
 23 1a55f0df-7498-63f2-a6df-053fbef8a951
 24 178bfe84-27ff-8b81-ae1a-f672a17b7525
 25 47811b25-736c-0a19-956d-edc02e2b8f0b
 26 da8aec0c-868b-3074-89f8-967fe543c5fa
 27 09bdca53-67dd-1758-b6c7-b8203363f24d
 28 86030acc-9aef-6f1f-adb6-eca1834281c7
 29 40d28241-0719-8910-a4e5-ac85c9ffdb76
 30 d5889ed7-3411-40b3-a9e7-f178e8b81bfb
 31 1500a76a-bb68-6ff9-9f5e-1d4db15b5a8b
 32 03d77a66-3c10-3ade-a12d-279245695355
 33 22a00a1c-683f-85bb-a901-118af9a4bf78
 34 ace70320-e208-7df0-b0cb-4c27014dcb7e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4747521417300172105431680316846387. Exactly this sequence comes out of new Random(34).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 20 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 34; the post has N = 34 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results