A858DE45F56D9BC9 archive

201208080033 xtvma

explained decrypted filler

seed 644

Metadata

Post ID
xtvma
Title
201208080033 → 2012-08-08 00:33 on A858's clock
Posted (UTC)
2012-08-07 16:30:34
Timezone
UTC+8 · title 00:33 against posted 16:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,512 hex characters · 1,256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
39
Filler GUID seed
new Random(644).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
23 · predicted N = 39 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

7026D3D1CB167757 F19AD610215492EC E34D0B2AFB043271 B53A0864B1A3D91F 8CDB4CE7151AFEF5 C27271E9F404E0FB B00F6B7C3CF328A5 4F33054C0AFA2185 A632990501054B7D 1080D0529E079372 D5877DD3C9A79724 B4D3850653DF387D 3ACF4E636F4A15C1 DD2C2E03DE24F043 3DF6DA4342871A24 5AA0EB4C80355075 4F8A9B3FF1C97620 CBBDC1130E7ED4C5 33CE9D0DE8B0F198 2D4B9B1EF1B0F9E6 70FFE98C7AB285AC 71BCBFFFF9E7CF7C A175C12E51EC2AFF 4389D4DAA9E79812 2595D1B1EBF1B817 7695BE8A53F564DA 59D313864484C506 E8F92106FE254350 9815C69A482C9446 D369C8C616D40014 67D4F0BAB327C7F7 EF1AD6FB4C35E5A0 0DD81B34271E4BA0 AE75BD5AE39306FA FF6B371463F9C29A 99039F216D4D0BE0 83DA153D8908D74B 87EC791E2CAEB18A A00FB204B43E031A 7014CBBA0E70799E 01B80DE0D10FE8B2 7807953EAD3B88A4 BB2BD9D81C5092ED 83755D83D168F093 28CDD1C462D8B11D 19D57C91AC204D52 11F1842EB074397D CFEA091872357E4A 96FAD772587F10E1 6F1CF9D56CE54D82 3D328F3B5324ADE6 4225B61CFFE1A19E 0753D19C505036FF CBBECE7E52384631 4F790042968FAE83 694CB87EBBCA8B83 A97F21913A3E3923 695258A6702286A9 96B26786EBFD2970 581E410FA8804984 D101C5E8FB633AA6 F6258FFB3FA657C3 E12628FF0B20F268 B0DD860E9590757D 935418B8AA96F46E 1E922F8C56177CA7 5D5D1A20231D68DD FFF3243CC992763A BF3735CFCF93714E EEAFCB0A51C7794C 2E9B2E9301CA1015 2A83D9C77195D801 9A45375596688342 401D652C6F19800A 2C8998FDD604061D 5A461A3C5B15B1EF 9B3FB554FB473337 3164E6A0D3B56F64 6B4B0753DE949C52 3DD61B475CB93134 C29311FFE27C2B85 D3A92ADC858492C3 88A8BF0F22FEDE59 56249B12D675E379 EF9AE73FFDD208CB E7906D92A9C096E1 A0CCB84107D4DB23 3713E45F0E85B49C 18E4D3F913CB5E70 E2007FFD5665EE7F A72028F559FE3F94 1F5D8C9A2C61B6CD D402780ABC680C83 660780E3E6B056BB 04D646DD9ACC8DB5 D469085086448653 AC0F698A7C58BCDA 475D4595C774261F D045A9A2231FBD57 37F1E1E2336E358B 9041CE265DE8056C F2E5CB4E4350F7A2 297338AFB80F2BA0 B3A28D491214CCE0 BA18DAD161FB47C1 1CA1CB4C9400CB9B 3CEFFF40A350E215 2FB6FBA5F415B7A6 85F152CB2547478D D6837C22D4D997DF 8865FCE8ECF1DA4E 90857E1E91EDDD45 F0E017490A6761F7 C406BC927795E472 BBDD7C13DF954AE1 DD416DFAE6C313B6 B30CF9EF7EAC6444 652F13CD46159414 14CE41C6B0FF3E1D C36DC1E7DE064552 8EDC833F0B356269 5DFAAFB69D6ECE1B A0D3A0F15E16B090 1AAEC6403ED923AE A2DE8900D9ABAA23 971049F8A3DC6A00 0F90462FA49334C9 406350B9D5F92D73 2D2CF2EFA11C121D 96C6FC73CD8A3E79 F3D2DF2786258414 4CC9FB37025725B5 C2DFC3EDB5B2C6E7 8EA0CAB2478F195D 7E1387B5B82B5AC9 B9BC236A16A7312D 1F9ED7D33233E5C1 EF95B0EFD428EBEE C4C2752A2D882FF5 89870050DA8F52CB 729E82299C3BCD58 DA904447438C4549 221918DEC134F347 68499DF1A3FDD503 14DD02913CCE1C9C 6FF6B4E866950FB0 DDA7FED6EA5A9AC5 516DA86099A6FC71 D08C9753EEE702B4 380497FE5C5119C3 17A1C14917247769 982B0D33DA564808 B9495BE3B3AAF1B9 A60CCD5BF59B7EA0 08D52EFA7F575755 186FE04F2FD76D2A 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).

Decrypted: GUID list

  1 717a9f19-4d5e-1a3c-86d1-da090220d7bb
  2 2d938b70-2821-7aa6-94a4-f8e2afde25e0
  3 76d5fb0d-966e-81f8-94bf-746058fef7b8
  4 98b23b8b-73e3-09c2-a155-0aaf95cf0779
  5 11d8aba6-59aa-8baf-959a-34728f06a29d
  6 97db3914-bfbf-3518-bd11-36d1e1ee53b3
  7 5123a89a-e666-49d5-966d-391aab699ff2
  8 25e366e6-f92e-43b2-ae24-4b5e6dee68eb
  9 be92f536-e71f-5792-8a0c-fecc58c71c0c
 10 5cfcfc3e-e17a-65b3-94ab-b6bb8f143f82
 11 db8fcd4f-434c-6509-b3d6-a9a7f5c1b6b1
 12 367e77cc-fc05-22df-972d-7ff7aadfb700
 13 267abaad-13d6-3a44-b526-7f33b24dcd5f
 14 d1edca58-05c1-443d-a976-b6be8bf9a38c
 15 794042d2-414d-69da-b280-fdb2c482322f
 16 c3aca648-6a76-1a2d-9547-0ecfc4a569a2
 17 e4421c15-a368-5b72-8b57-fe723f83e5ca
 18 ac8dd35c-aa3c-2511-bf34-eace7329c773
 19 16ec703f-ae7b-00e4-a64f-720b0f8b888b
 20 d7083eb0-8107-6534-b8f1-7a5a935e71d6
 21 36e2d7b3-5cfb-3099-b3dc-61fef53d122c
 22 d30f320b-fdc2-7041-8c49-c717b9aa355b
 23 b2cb20e8-5855-75d8-8d6f-dbec6a10a1b9
 24 0c7b6488-a93b-0428-8c04-f7b3e9559b09
 25 5708081a-2d8e-7a67-9560-cf3da41c58e6
 26 a5c839b6-1bbb-66fd-8b87-8963d667f3ec
 27 45481d1e-cf0d-57f4-b5cb-6cc28c111f49
 28 2e931cd5-9e89-6843-a5aa-1f85e30d309e
 29 c6a04154-ab30-3e95-aa22-9a8db04900c2
 30 fe56de96-0ee8-6463-8bce-4984fbb46e81
 31 ed9dcb65-ac20-8872-841e-f4e38b8bf368
 32 8b7bffb4-259a-0a46-835c-6f39ac114d49
 33 213b1e39-e012-2e45-afc0-ef88da903b68
 34 ea45c23a-8bc9-193b-afd4-20280e87c6af
 35 1a07f5dc-c22f-48f3-9222-077640e2c1a1
 36 175a5ecf-9e18-6ed3-890f-694f1db09fcc
 37 1dd52f56-eb49-46fe-9359-46cc34eac0c8
 38 b68fcf3a-30c9-249c-8a68-642f5ca87991
 39 d6db635d-8d0c-5904-869c-9870aa91695d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 178083445662346152063770765636802146425. Exactly this sequence comes out of new Random(644).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 23 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs