A858DE45F56D9BC9 archive

201208080021 xtuur

explained decrypted filler

seed 503

Metadata

Post ID
xtuur
Title
201208080021 → 2012-08-08 00:21 on A858's clock
Posted (UTC)
2012-08-07 16:18:32
Timezone
UTC+8 · title 00:21 against posted 16:18 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
37
Filler GUID seed
new Random(503).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
21 · predicted N = 37 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
39 · 46
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

195C2F25D0E66F27 8222E8A5A5B61810 BB1C5C9659241561 7D4809C4F20593FB 1774C2EE38D04E9C 67A9788E4237AA86 6DA703DA45B1E3B2 5A461135F333F17E B0E18AE56A4F8C69 2BE07DCBC4D098BA 4973A5DAA557290F 983554B41456FE27 957707CFD62675BE 0DE91AD2DCD3ACD5 FEA2363F7222ECF1 392FB4A8BC3F3780 3838DCFC9974F95B 5C6084391EEEA4E6 6E6219B23D36A85D DE32A4CD5ED4FE49 A1B36B3A33DFD1E3 D174104A587B0628 CB6737F165CEB48B 9FB2A1E413B30214 640586436F213C7C FFFA78D71BFAB9A6 87521C51B792E787 603A3A91F7E30068 4653F0F59CC24FDA 6BA3D0D945314944 310C699872216010 F6F54B9294B3E6D1 F94F7BD11E4D8F6F B3B12E5B873862A3 2E5F6D246829E2A9 0C806F6E2802AFB6 061985519EFD3A76 9273CAC3A76D717A 866D2DC1EC9E03DC C154C6588E466708 B39254CB17A4E858 F815752121E5ECAF 3C08A48F2061BCC9 EA91F627C379017B 553F93AF1A43A9A0 B2E17E291EDC302D 5D303EC8FE627BFA 949617456446A24B A5844FB01DB72A5B 92A09B4692A81529 24D540D381144D43 65C88D95A89CB256 0342EEF13F3E35E6 78E10A8993E972BC A9DCC74F6072A08A DC8C4E1CBFB946A6 BB73EEBA9F1038CD E35943127C464735 828A1412D59D1238 CA56369E1881F702 C995367D798521B9 3411146CDF89DF82 E178B0F70A50DB7E AAA31999405A3490 0E7D848D12005BAD 49FC4C025833AFC5 4C5E005AFF6E6E3D 824BE4C712AEA321 C03244765B593676 B89DF3E963860DC1 9E0681315D488341 4D15040122A6A6A3 65A6844EBBA999F9 CBF196C4DE00B346 3C24BD1C61A681E8 8CDB391270C8D035 901696CDB0F77FA5 5DBF4802BF8F9B5C B193992FAF593A2A 3B1F34F08B108602 DDF939BE15675444 90E168289DC7FD78 4DF5BE13BC27C20A 23A546432EEB7C96 98502BC62F4F7C33 E5F5CACAFD2E9C52 D7C4AD90348531D6 B609C2541A100111 E02E19B4CA49FB28 A740E4606C9F817E A2F0C12CE72B515A E5869804FE161F41 D5C116AA25C19225 9DFF52441D4376E8 DE704E2CCFF4980D 162D915B17BB8469 599586A5C36189D2 B529E09542A4C448 C0076BD8495BB042 9913BF27E99DCD91 68FD2EC761D7C3CC F6C573D227954994 C86FEC9D2C91215D F7478938377B1710 898F6528DD75CF16 AB5ABE3250C5C69C 0FB0DE891C52FC36 77DCAB0E8ECFEA73 619189DA2AC7BF32 0755383FF0633E10 2F422ADF4AA759D2 9E4C68730B97EB0B 841C44D093CD6880 AE60DBB8F6787DE1 E0295010F67E6A32 B8F2C9664F800FF4 398B8CD42AF0B8D9 297FCA6031F09D91 5B2DBEBA3D23A67F B6CBEA73E606538B CA36B86D07F164E1 E36E491A17DA14ED 0FFFE085006F99D5 AD5066F05B74462D 58950F62004CCD04 119E4EE149986191 494E92567D5159C5 A818C859EE24EFA1 0C1885D5D6B3EAC3 6FB8FDF0652EA10F B46D08C40CA49A9C E157D4DDF400F27E D7D890E62973B660 45160C728C254D89 89D7497D3D06C952 264C88C8167F90C2 C867BBA74388BFC8 47406AD86D966D9F 9CB52DEF2534FA95 BE4766C7567576CE F227C9D64B63651F ED842ED86631D633 7BBD589C1A03B240 C32E6A500B617AF8 B1B6AA450ADFA33F 672B08BAB45D4DA3 44EC12F2107445F4 41101F08758D98E3 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4b76fdc0-6d60-40b6-84a8-24c3c834e5f1
  2 5b4c95fd-b570-3559-87cf-b3cfee247a3f
  3 a54ecf87-4ec8-3bd7-b6dd-10e43c81a9ce
  4 93f1e09d-2ddd-8765-8c1a-8990731e3adc
  5 5715ded8-fe84-276b-9299-2e5f690c918d
  6 e99df2a9-ca01-125b-8568-32c81fcf31c6
  7 81537ccc-d80b-2ba8-bbde-bccda2ff4ce7
  8 1c0aec6a-2004-7ba8-a2a6-0ea0f8737c27
  9 0fb69cc5-9453-146e-b586-88d8dbe13803
 10 01bddce1-affe-6728-a8f4-67c0668b57a5
 11 14e14336-a375-739a-ad9d-a883ae573e86
 12 9825d7c1-a405-1843-8333-e7b7c97fc3ca
 13 87ae45b6-f215-3981-ba72-a1f12a69957a
 14 cebdf396-65f3-1c02-9618-eda902d05ce3
 15 5c39c0cb-f772-0f90-8fbf-5140f5c28cad
 16 390c843d-f181-15cb-b43a-0c32b98d4641
 17 270e628a-4990-20ab-b17e-1914101f7661
 18 7939fb25-0333-72df-92a0-f1779be3cf26
 19 25e346a8-57a3-2afa-867f-5f209f1b9e3b
 20 ab44e3af-f8d6-0e17-ba21-fb5b59680afe
 21 a4def304-433d-5b66-8d27-4d166d2b4206
 22 a369d8de-2f59-25bf-8f9d-1ad79e5bfcf5
 23 50af2d39-723a-0717-8cd0-1fb5b3e6e544
 24 3f44e4c0-10d0-65ad-93ee-4280aefb8f5e
 25 f2e16108-1c0b-8ff8-972d-4d9c19497e5c
 26 1584df85-00eb-012c-b87b-cb8036a3f2c4
 27 d91a2074-3dcc-3a9d-884b-842d30d79c56
 28 5e064bd4-eca9-3408-a37a-ae33e831cedf
 29 62682179-1f35-4ef7-b19b-8008b8470b84
 30 a6ae31af-725b-1713-92de-642b24ee18fc
 31 41b324df-7ee7-7a69-b2c9-471b220d5a1e
 32 5442f291-931c-863d-a557-e707446b161a
 33 a8d3b1d3-55eb-58e5-b8b6-51d42831de03
 34 00be328d-35b4-53fe-9866-79a579e74cca
 35 be92aaa5-1aaa-2b69-84ba-82197d2056a7
 36 c68792a5-a1de-548b-986b-447e9b50beb5
 37 be2f5814-70ec-61f8-970e-7704d2d26662

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4338212716713101272052068033417855256. Exactly this sequence comes out of new Random(503).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 21 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs